EarningFarm is a set of smart contracts that manage crypto assets. It has a native token, EF, that is used to demonstrate the amount of funds put into the protocol. The amount of EF token is...
Treasure DAO was the largest NFT marketplace Arbritrum. Recently, it was hacked. But how? The function buyItem() can be used to purchase existing listings to be bought for no fee on the NFT...
Microsoft Remote Procedure Call (MSRPC) is a prevalent communication mechanism that provides an extensible framework for defining server/client interfaces. The author wrote a tool called...
Edge Side Include (ESI)is a small set of XML tags in HTTP solutions, like caching or a reverse proxy, to fetch more information about a page for which a template is cached. For instance, a caching...
AWS Admins use CloudTrail to monitor API activity within their accounts. This allows suspicious activity to be discovered quickly. So, what would happen if we could bypass this? An admin could...
Oracle CDE (Common Data Environment) is a tool to collect all project information into a single platform. This is done via cloud syncing, I presume. The authors of this post had recently found...
Adobe ColdFusion is an IDE by Adobe Systems. It used to develop Colfusion Markup Language apps. The administrator has all server databases stored in a single location, which is where the bug...
The Issuer on a Certificate is completely useless. Many of them are defunct companies or were bought out by another Certificate company. Since certs can last a long time or the purchasing company...
The Wiz and Tines partnership empowers organizations to protect their cloud infrastructure at scale with no-code automation.
On 2023-01-19, a research was reported, involving , gaining initial access via Software misconfig, targeting Jenkins to achieve Resp. disclosure.
Article about all of the smart contract vulnerabilities of the year. I'm going through the hacks and findings one by one, but still wanted this documented for later. Good detailed writeups and a...
Gnosis Chain's native token xDAI contains the non-standard hook callAfterTransfer in their token. This surprised many protocols, leading to security issues down the road. Hundred Finance is a fork...
TrueUSD is a stablecoin backed by the USD dollar. Recently, ChainSecurity did an audit of the Compound cToken contract, which uncovered a new vulnerability. The concept of Double-Entry Point...
An NFT airdrop is how freshly minted NFTs go into multiple wallets at once. ApeCoin was distributing a large amount of NFTs to Bored Ape Yacht Club (BAYC) and Mutant Ape Yacht Club (MAYC) NFT...
Detect and mitigate CVE-2022-44877, a CentOS Control Web Panel (CWP) unauthenticated RCE exploited in the wild. Security teams are advised to patch urgently.
Code signing applications is an essential part of the macOS security model. Being able to bypass signing and verification steps would be a major flaw in the system, leading to users being at risk....
The authors of this post come from Star Labs - a usual team at Pwn2Own. They detail several cool vulnerabilities that were patched a little bit before the event. They targeted a Netgear router, in...
wolfSSL is a TLS implementation written in C. The author of this post had previously written a protocol fuzzer called tlspuffin, which they decided to target wolfSSL with since several bugs had...
Zora has a module for allowing users to list any NFT for sale at a fixed price and currency. This is referred to as AsksV1 or Buy Now in the ecosystem. A potential buyer is able to fill that...
Sherlock is a blockchain auditing platform in the form of contests. They had a staking pool setup with Euler. The function balanceOf on the EulerStrategy.sol is used to determine the current value...
Gearbox is a composable leverage protocol. It allows a user to take leverage on collateral asset and use the borrowed funds through CreditAccount across DeFi. A common functionality for every...
Superfluid.sol allows for composable Superfluid agreements in a single transaction. I have no idea what this means (lolz). The important thing to note is that the main contract and the agreements...
The bug report CVE-2022-42703 by Jann Horn is a use after free on struct anon_vma in the memory management (MM) subsystem of the Linux kernel. The vulnerability is extremely complex and particular...
Django is an open source Python framework used for web applications. It is used by many organizations as the backend web server for a website. Django is an MVC (model view controller) framework....
Pwn2Own is a competition focused on finding vulnerabilities in high value targets. In this rendition of Pwn2Own for IoT devices, they choose the Netgear Router RAX30. Pwn2Own has many tough...
Cacti is an open source monitoring solution used by many different companies. They found this initially by scanning for bugs with their tool. The application is written in PHP. At the very...
Spring Boot has a pretty famous issue: when data is reflected within an error message, the Exception message uses Spring Expression Language (SpEL). For instance, $(7*7) will render 49. The...
The author had an old cable modem sitting in their closet. While browsing some forums, they learned that the device had a built in spectrum analyzer for diagnostics. So, they wondered, if a cable...
One Key has recently created an automated scanner for scripting languages and compiled binaries. To start with, they support Python and PHP scripting languages with various bug classes, such as...
This is the final part of the series. In the first two posts, an SSRF, LQL query injection leads to an arbitrary file deletion. This leads to a complete authentication bypass by racing a file for...