[tl;dr sec] #170 - Prototype Pollution, Fuzzing, SOC Metrics

Hey there,

I hope you’ve been doing well!

Focusing on the Right Stuff

I was going to write you a lovely intro, but unfortunately I’m behind this week.

So instead I shall briefly leave you with some things that made me smile.

It’s worth watching the video:

And from a classic novelty Twitter account:

Web Security

Damian89/yataf
By Damian Strobel: A tool written in Go to extract secrets and paths from files or URLs.

Semgrepper
@gand3lf’s Burp Suite extension that adds Semgrep rules into passive scan checks is now live on the BApp Store.

SSO Gadgets: Escalate (Self-)XSS to ATO
Lauritz Holtmann provides an overview of the fundamentals of OAuth2 and OIDC, while raising awareness about the potential impact of incorrect SSO configurations. Lauritz explores how SSO gadgets can turn a seemingly benign self-XSS vulnerability into account takeover, and provides real-world examples that demonstrate each gadget, as well as mitigation strategies to counteract them.

Unleashing the power of CSS injection: The access key to an internal API
Alserda’s Sander Wind writes about how he and other researchers were able to turn a CSS injection identified in an application’s PDF generator into reading local files and SSRF, and via SSRF probe internal hosts. The library used to render PDF files defined a property (reading the docs 🤘) that allowed JavaScript code to be included and executed when a PDF file was opened.

Firefly: a smart black-box fuzzer for web applications testing
YesWeHack’s Brumens shares Firefly, a new black-box web application fuzzer inspired by James Kettle’s Backslash-powered scanner. After first determining an app’s baseline responses, it starts fuzzing with different payloads and input modifications to determine how the app modifies and transforms data, which can be used to detect backend functions, normalizations, and/or bypass security filters used by the system.

Prototype Pollution

Server-side prototype pollution: Black-box detection without the DoS
PortSwigger’s Gareth Heyes explores various techniques that can be safely used to identify server-side prototype pollution without compromising the core functionality of the application, and releases a free Burp extension that implements the tests. In addition, Gareth provides some tips for debugging Node applications and techniques to prevent these type of vulnerabilities.

Server side prototype pollution, how to detect and exploit
YesWeHack’s BitK describes prototype pollution, how to find gadgets, and introduces pp-finder, a tool that makes it easier to find prototype pollution in JavaScript codebases.

PP Finder works by using the TypeScript parser to generate ASTs for each file, then modifies the tree to inject hooks that detect if an undefined property is accessed. You then run the modified code and PP Finder reports potential gadgets and tells you the relevant piece of code. Rad. Using PP Finder, they found vulnerabilities in Express, Fastify, VueJS, JSDom, and Axios.

Detecting Server-Side Prototype Pollution
Intruder’s Daniel Thatcher describes another black-box method to detect server-side prototype pollution:

1. Find an endpoint that fails if a certain argument isn’t provided.

2. Then attempt to prototype pollute with that argument name across each other endpoint, checking the original endpoint after each request.

3. If the original request succeeds without you provided the required argument, then you have successfully found prototype pollution.

Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js
Academic paper by Mikhail Shcherbakov, Musard Balliu, and Cristian-Alexandru Staicu.

Fuzzing

cURL audit: How a joke led to significant findings
Trail of Bits’s Maciej Domanski describes extending AFL++ to better support fuzzing CLI arguments, and how that enabled them to find use-after-free, double-free, and memory leaks in libcurl, which is used by many applications.

Some additional tips I liked: using curl’s man page to seed the fuzzing dictionary, and using iptables to redirect all TCP packets to localhost and then using netcat to listen for connections from cURL.

CODAMOSA: Escaping Coverage Plateaus in Test Generation with Pre-trained Large Language Models
Very cool work by UBC’s Caroline Lemieux. Tool source code.

Cloud Security

aws-samples/aws-scps-with-terraform
Set up a template to easily create and apply AWS Service Control Policies (SCPs) with Terraform.

awslabs/aws-break-glass-role
Create a break glass role for emergency use in order to limit production console access. Configure automatic alerts and logging of activities in the role to secure its use in production environments.

Create a Console Session from IAM Credentials
If you’re performing an AWS assessment and you encounter IAM credentials, Nick Frichette describes how to spawn an AWS Console session using a tool like aws-vault.

Cedar: A new policy language
Ian Mckay from One Cloud Please writes about Cedar, a new language created by AWS to define access permissions using policies, similar to the way IAM policies work today. Ian covers why Cedar was created, how to author policies, and some additional language features.

Cedar can be used for non-AWS applications, is written in Rust, and was designed to be simple to reason about if two policies are exactly equivalent.

Container Security

Restricting cluster-admin Permissions
By Giant Swarm’s Marcus Noble: By default, Kubernetes cluster operators are assigned to the cluster-admin ClusterRole, allowing them to perform any action. RBAC only allows for adding permissions, so if you need to block an action performed by cluster admins, you can leverage an admission controller like Kyverno.

OWASP Kubernetes Top 10
Sysdig’s Nigel Douglas groups the OWASP Kubernetes Top 10 into three categories in order of likelihood (misconfigurations, lack of visibility, and vulnerability management), describes the risks, mitigations, and shares relevant tools.

Blue Team

Extract Actionable Intelligence from Text-based Threat Intel using Sentinel Notebook
Microsoft’s Vani Asana introduces the MitreMap Notebook, a notebook that uses the GPT2 language model to map unstructured descriptive text of an incident to the relevant MITRE ATT&CK Enterprise techniques, as well as identify the tools, techniques and procedures (TTPs) used by the actor group and the Indicators of Compromise (IoCs) in the report.

How to Categorize and Prevent Risks of Sensitive Links in URLScan
Tinder Security Labs’ Rojan Rijal, Johnny Nipper and Tanner Emek write about how misconfigurations on the URLScan service used to identify potentially malicious websites could sometimes expose internal assets, domains and sensitive information to the public and be leveraged to gain access into corporate systems.

Airbnb’s Approach to Access Management at Scale
Airbnb’s Paul Bramsen discusses how the implementation of a centralized, self-serve access control platform has helped enable Airbnb’s large team of employees, contractors, and call center workers to perform their jobs efficiently and effectively in almost every region of the world. This has also helped Airbnb maintain trust while complying with legal requirements.

Performance metrics, part 1: Measuring SOC efficiency
Expel’s Jon Hencinski writes on how ineffective operations management can lead to SOC burnout and shares his vision on how to set up a measurement framework that helps SOC leads ensure goals are being met, creating a metrics strategy, and three metrics they believe are fundamental to managing a SOC:

1. When do alerts show up? (alert seasonality)

2. How long do alerts wait before a robot or an analyst attends to them? (alert latency)

3. How long does it take to go from alert to fix? (remediation cycle time)

Misc

Why Do Modern Pop Songs Have So Many Credited Writers?
How modern songwriting evolved into a game of aggressive credit—even for the people who didn’t technically do the composing.

The rewriting of Roald Dahl

The ‘Enshittification’ of TikTok
By Cory Doctorow, with examples of Amazon, Facebook, Google, and TikTok.

Apparently Cory has a new book, Chokepoint Capitalism, on “how big tech and big content captured creative labor markets, and how we’ll win them back.”

✉️ Wrapping Up 

Have questions, comments, or feedback? Just reply directly, I'd love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,

Clint