[bounty] Rapid Reset, Attacking AWS Cognito, and Confluence Bugs

Day[0]

Content provided by dayzerosec. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by dayzerosec or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.

10M ago 29:52

MP3•Episode home

We've got a mix of topics this week, started with a bit of discussion around the recent Rapid Reset denial of service attack, before diving into a few vulnerabilities. A Node "permissions" module escape due to having a fail-open condition when unexpected but supported types are passed in. Then we talk about some common AWS Cognito issues, a fun little privilege escalation in Confluence, and a log injection bug leading to RCE.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/219.html

[00:00:00] Introduction

[00:00:15] HTTP/2 Rapid Reset Attack [CVE-2023-44487]

[00:04:35] [Node] Path traversal through path stored in Uint8Array

[00:09:44] Attacking AWS Cognito with Pacu

[00:14:33] Privilege Escalation Vulnerability in Confluence Data Center and Server [CVE-2023-22515]

[00:21:15] Not Your Stdout Bug - RCE in Cosmos SDK

The DAY[0] Podcast episodes are streamed live on Twitch twice a week:

-- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities

-- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.

We are also available on the usual podcast platforms:

-- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063

-- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt

-- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz

-- Other audio platforms can be found at https://anchor.fm/dayzerosec

254 episodes

#Tech #dayzerosec