May 2020 Summaries

HTTP request smuggling is a sophisticated attack method that exploits the way HTTP devices, like front-end proxies and back-end servers, handle requests, allowing attackers to modify requests by manipulating the Content-Length or Transfer-Encoding headers. This manipulation can result in an additional request being smuggled into the main request, bypassing security measures and potentially accessing restricted areas, such as admin pages. The attack is facilitated by conflicts in HTTP specification, where both Content-Length and Transfer-Encoding can be used to define request boundaries, leading to vulnerabilities when both headers are present in a request. Detection tools like Burp Suite and Detectify can identify such vulnerabilities, and remediation involves using consistent server configurations and disabling back-end connection reuse. The attack's impact can range from accessing sensitive files to account takeovers, highlighting the importance of robust security measures and awareness of HTTP specifications.

Detectify, a security tool provider, issues major updates every two weeks to ensure their scanner remains current with new findings and improvements from their security researchers and the Crowdsource ethical hacker community. While confidentiality agreements limit the public disclosure of these updates, users have immediate access to them. Recent enhancements to the Detectify scanner include tests for security vulnerabilities identified by the ethical hackers. Notably, these include the CVE-2020-11514 vulnerability in the WordPress SEO plugin Rank Math, which could allow unauthorized privilege escalation, and the CVE-2020-11455 vulnerability in LimeSurvey, which presented a path traversal risk. Additionally, a module has been added to check Atlassian Confluence instances for the public exposure of internal documentation, a concern that has become more significant as companies increasingly migrate online due to COVID-19.