TL/DR: In this world of rapid digitization, companies are moving from traditional on-premise deployments to cloud service providers for handling their infrastructure. In this article, …
TL;DR Combining response-type switching, invalid state and redirect-uri quirks using OAuth, with third-party javascript-inclusions has multiple vulnerable scenarios where authorization codes or tokens could leak to an attacker. This could be used in attacks for single-click account takeovers. Frans Rosén, Security Advisor at Detectify goes through three different scenarios found in the wild below.
CloudKit, the data storage framework by Apple, has various access controls. These access controls could be misconfigured, even by Apple themselves, which affected Apple’s own apps using CloudKit. This blog post explains in detail three bugs found in iCrowd+, Apple News and Apple Shortcuts with different criticality uncovered by Frans Rosen while hacking Cloudkit. All bugs were reported to and fixed by the Apple Security Bounty program.
Note: This issue has been resolved and the .cd ccTLD no longer sends NS delegations to the compromised domain. TL;DR: Imagine what could happen if …
Our guest blogger and Detectify Crowdsource hacker 5w0rdFish details her research on Hexedglobals.3793 family of PHP-based malware and the de-obfuscation process. This article covers the …
TL;DR Bucket upload policies are a convenient way to upload data to a bucket directly from the client. Going through the rules in upload policies and the logic related to some file-access scenarios we show how full bucket object listings were exposed with the ability to also modify or delete existing files in the bucket.
In this guest blog, security researcher and Detectify Crowdsource hacker Jon Bottarini writes about the interesting bugs he discovered when he took a closer look …
Bypassing CSP with Google Analytics