research

ElectroNG is a tool for analyzing the security of ElectronJS applications. It allows security researchers to quickly identify potential security issues in ElectronJS apps, such as insecure webPreferences settings, unsafe preloads, and other common pitfalls.

Official Website
https://get-electrong.com/

Code
https://github.com/doyensec/electrong
https://github.com/doyensec/electrong-core

Announcement
https://blog.doyensec.com/2026/10/27/electrong-oss.html

Doyensec discovered multiple vulnerabilities in SFAPE.dll, a VBS enclave shipped with Windows, and chained them to gain code execution within the enclave in Windows Isolated User Mode (VTL1). The post explores how VBS enclaves work and how memory corruption can undermine their isolation guarantees. Microsoft addressed the reported issue in the September 2026 bulletin under CVE-2026-83498.

Read the blog post: https://blog.doyensec.com/2026/10/13/Sfape.html

Doyensec identified a vulnerability in Chrome for iOS that allowed a malicious webpage to bypass the browser's app-launch protections by leveraging the trusted shortcuts:// and workflow:// URL schemes. By supplying an attacker-controlled x-error to the Shortcuts application, a webpage could cause a secondary URL such as tel: to be opened after a single user click without Chrome applying its normal confirmation or user-interaction checks. The vulnerability was assigned CVE-2026-13795.

Read the full analysis: https://blog.doyensec.com/2026/09/24/chrome-ios-policy-bypass.html

We discovered a deterministic local privilege escalation vulnerability affecting the default install of the latest Arch, Fedora, Debian, Amazon Linux and RHEL distributions, having unprivileged user namespaces enabled, `openvswitch` auto-loading, and a stock kernel carrying the Fragnesia fix. The issue has been public since 08/13/2026 on netdev, and the fix landed in mainline and shipped in stable on 09/04/2026.

✓ Detailed analysis: https://blog.doyensec.com/2026/09/17/ovs.html
✓ Exploit: https://github.com/doyensec/ovs-pagecache-write

Doyensec identified a security issue affecting the ElectronJS framework. The shell.openPath() API did not reject file paths containing embedded null bytes, allowing string-based path validation (such as file extension allow-lists) to be silently bypassed and a different file to be opened than the one that passed validation, potentially leading to code execution.

All details in our advisory: GHSA-5c9j-mhmv-5xgx

Doyensec identified two security issues affecting the Fider web application. A user-controlled OAuth URLs allowed for Server-Side Request Forgery (SSRF) on the target deployment, and a cross-tenant invitation acceptance vulnerability, leading to unauthorized access.

All details in our advisories:
- Fider_OAuthURL-SSRF_Q22026.pdf
- Fider_Cross-TenantInvitationAcceptance_Q22026.pdf

Authorization testing is one of the most repetitive, yet critical tasks in web app security testing. Checking for horizontal and vertical privilege escalation, IDORs, and other access control issues requires constantly swapping cookies and headers between different user sessions, a process that is error-prone and often becomes tedious.

We're releasing Session Switcher, a Burp Suite extension that lets you save and switch HTTP sessions with just a couple of clicks, right from the request editor.

Blog Post: https://blog.doyensec.com/2026/06/17/session-switcher.html

This whitepaper provides a comprehensive comparison of Aikido and XBOW, two leading AI application security testing platforms. It evaluates their features, capabilities, and performance in identifying security vulnerabilities in modern web applications.

Whitepaper: Download Here (PDF, 5 MB)
Resources: Download Here (ZIP, 44 KB)

ELBaph whitebox CLI tool for pentesters and security engineers to enumerate AWS Application Load Balancers and detect common routing misconfigurations that expose internal services to the public Internet.

Code: https://github.com/doyensec/elbaph

CloudSec Tidbits is a blogpost series showcasing interesting bugs found by Doyensec during cloud security testing activities. Each blogpost will discuss a specific vulnerability resulting from an insecure combination of web and cloud related technologies. Every article will include an Infrastructure as Code (IaC) laboratory that can be easily deployed to experiment with the described vulnerability.

Episode 5 (post): https://blog.doyensec.com/2026/05/25/cloudsectidbits-elbaph-alb.html
Episode 5 (code): https://github.com/doyensec/cloudsec-tidbits/tree/main/lab-elbaph

Our second blogpost on NASA's CFITSIO library. This time we are presenting our research on logical and architectural issues identified in the Extended Filename Syntax.

We show how documented filename-processing features can be chained into security-relevant primitives, including arbitrary file copy, server-side request forgery, HTTP header injection, and local file exfiltration through the legacy root:// driver.

Blog Post: https://blog.doyensec.com/2026/05/19/cfitsio-weaponized-filenames.html

Download the PDF slides for Adrian Denkiewicz's presentation on how CFITSIO EFS can be abused to enable multiple high-impact security primitives, including arbitrary file operations, server-side request forgery, protocol-level manipulation, and unintended data exposure.

maSSO is a weaponized Single Sign-On (SSO) Identity Provider (IdP) for security testing of OIDC and SAML 2.0 Service Providers, also supporting SCIM.

Code: https://github.com/doyensec/maSSO

CloudSec Tidbits is a blogpost series showcasing interesting bugs found by Doyensec during cloud security testing activities. Each blogpost will discuss a specific vulnerability resulting from an insecure combination of web and cloud related technologies. Every article will include an Infrastructure as Code (IaC) laboratory that can be easily deployed to experiment with the described vulnerability.

Episode 4 (post): https://blog.doyensec.com/2026/05/05/cloudsectidbits-masso-cognito-sso.html
Episode 4 (code): https://github.com/doyensec/cloudsec-tidbits/tree/main/lab-masso

This article presents our research on memory corruption vulnerabilities in NASA's CFITSIO library, a widely used FITS processing toolkit in the astronomy ecosystem.

In particular, our work focused on the library's Extended Filename Syntax. Through fuzzing and Codex-assisted analysis, we identified multiple memory corruption issues. We experimented with AI-generated patches and gathered useful feedback from the library maintainers.

Blog Post: https://blog.doyensec.com/2026/04/20/cfitsio-fuzzing.html

This article shares our perspective on the current state of authentication and authorization in enterprise-ready, remote MCP server deployments.

Authentication and authorization, especially in the context of SSO and transitive trust across third parties, have historically been a breeding ground for subtle, high-impact vulnerabilities. MCP does not change this reality. If anything, by introducing additional layers of indirection, remote server pooling, and agent-driven workflows, it amplifies the existing complexity. In the near term, we should expect authentication and authorization in MCP deployments to remain a challenging and error-prone domain.

Blog Post: https://blog.doyensec.com/2026/03/05/mcp-nightmare.html

We have open-sourced Electron SafeUpdater, a secure, cryptographically-verified auto-update system for Electron applications.

The project focuses on protecting critical update assets such as manifests, binaries, signing keys, and distribution channels through cryptographic verification and strict validation mechanisms.

The repository is available on Github at https://github.com/doyensec/ElectronSafeUpdater

We've also released a blog post explaining the motivation and design behind this software: https://blog.doyensec.com/2026/02/16/electron-safe-updater.html

In July 2025, we performed a brief audit of Outline - an OSS wiki similar in many ways to Notion. This activity was meant to evaluate the overall posture of the application, and involved two researchers for a total of 60 person-days. In parallel, we thought it would be a valuable firsthand experience to use three AI security platforms to perform an audit on the very same codebase. Given that all issues are now fixed, we believe it would be interesting to provide an overview of our effort and a few interesting findings and considerations.

Article: https://blog.doyensec.com/2026/02/03/outline-audit-q32025.html

Based on a recent Android reverse engineering engagement, we explore intercepting OkHttp traffic with Frida. The post demonstrates why this is rarely as simple as hooking the final network call, and shows how requests evolve through interceptor chains at runtime. It also illustrates how Frida can be used to reconstruct application-level protocols even in the presence of signing and encryption.

Article: https://blog.doyensec.com/2026/01/22/frida-instrumentation.html

In the latest part of our ksmbd series, we focus on exploiting CVE-2025-37947. This article summarizes the whole process of confirming the bug, creating a simple PoC, and weaponizing the exploit to achieve local privilege escalation on Ubuntu 22.04 LTS with the latest kernel version.

Article: https://blog.doyensec.com/2025/10/08/ksmbd-3.html

Building on our earlier exploration of C# Random, a new blog post examines VBScript's Randomize internals. This article reveals how flawed seeding and state mixing make token recovery practical.

Blog post: https://blog.doyensec.com/2025/09/25/yet-another-random-story.html

We continued our vulnerability research on the SMB3 Kernel Server (ksmbd), expanding coverage across different configurations and fuzzing approaches. In total, we reported 23 security issues, many with potential for local privilege escalation and remote code execution.

Article: https://blog.doyensec.com/2025/09/02/ksmbd-2.html

Drawing on our experience with real-world security code reviews, we dive into how to identify and test for some cryptography-related vulnerabilities, explaining them with and without the math.

Blog post: https://blog.doyensec.com/2025/08/19/trivial-exploit-on-C-random.html

Semgrep has rapidly become a widely-used SAST tool. It has positioned itself in some ways as the middle-ground between a team creating their own scripts to "grep" through a codebase looking for bugs and going all-in with a major investment, in time and/or money, to implement a more robust and/or commercial solution. A team that finds Semgrep's Community Edition useful will likely find itself asking whether they would see a positive ROI on moving up to using Semgrep's commercial version, called "Semgrep Code". Our research contrasts the effectiveness of Semgrep's SAST solution to determine if there are meaningful differences between the community and paid versions.

The full technical whitepaper for this sponsored research is now available: Comparing_Semgrep_Pro_and_Community_Whitepaper.pdf

Download the PDF slides for Szymon Drosdzol's Confidence 2025 presentation on common API authorization anti-patterns and how to avoid them.

In this blogpost we dive into SCIM (System for Cross-domain Identity Management) core aspects & the insecure design issues we often find while testing custom implementations.

Blog post: https://blog.doyensec.com/2025/05/08/scim-hunting.html

Expanding upon our previous ksmbd research we have already been credited with 18 CVEs on ksmbd so far in 2025! These include multiple use-after-frees, bounds checks, type confusion and overflows.

Here is the current list:

• ✔️ fix the warning from __kernel_write_iter (CVE-2025-37775)

• ✔️ fix use-after-free in smb_break_all_levII_oplock() (CVE-2025-37776)

• ✔️ fix use-after-free in __smb2_lease_break_noti() (CVE-2025-37777)

• ✔️ validate zero num_subauth before sub_auth is accessed (CVE-2025-22038)

• ✔️ fix overflow in dacloffset bounds check (CVE-2025-22039)

• ✔️ use-after-free in ksmbd_sessions_deregister() (CVE-2025-22041)

• ✔️ fix r_count dec/increment mismatch (CVE-2025-22074)

• ✔️ add bounds check for create lease context (CVE-2025-22042)

• ✔️ add bounds check for durable handle context (CVE-2025-22043)

• ✔️ prevent connection release during oplock break notification (CVE-2025-21955)

• ✔️ fix use-after-free in ksmbd_free_work_struct (CVE-2025-21967)

• ✔️ fix use-after-free in smb2_lock (CVE-2025-21945)

• ✔️ fix bug on trap in smb2_lock (CVE-2025-21944)

• ✔️ fix out-of-bounds in parse_sec_desc() (CVE-2025-21946)

• ✔️ fix type confusion via race condition when using ipc_msg_send_request (CVE-2025-21947)

• ✔️ prevent out-of-bounds stream writes by validating *pos (CVE-2025-37947)

• ✔️ prevent rename with empty string (CVE-2025-37956)

• ✔️ fix use-after-free in ksmbd_session_rpc_open (CVE-2025-37926)

To support the community, we have compiled a list of blog posts, vulnerabilities, tools, CTF challenges, and videos related to Client-Side Path Traversal.

Blog post: https://blog.doyensec.com/2025/03/27/cspt-resources.html

For our last company retreat, the Doyensec team went on a cruise along the coasts of the Mediterranean Sea. In between trips and pool parties, we challenged ourselves to exploit three vulnerabilities in three different categories: IoT, web, and binary exploitation.

Our third (and last) episode of the !exploitable series covers Gitlab's CVE-2024-04023 arbitrary file write.

Blog post: https://blog.doyensec.com/2025/03/18/exploitable-gitlab.html
Exploit code (RCE): malicious-devfile-registry

For our last company retreat, the Doyensec team went on a cruise along the coasts of the Mediterranean Sea. In between trips and pool parties, we challenged ourselves to exploit three vulnerabilities in three different categories: IoT, web, and binary exploitation.

Our second episode of the !exploitable series covers the infamous SSHD exploit used by Trinity in the movie The Matrix Reloaded.

Blog post: https://blog.doyensec.com/2025/03/04/exploitable-sshd.html
Exploit code: main.c

For our last company retreat, the Doyensec team went on a cruise along the coasts of the Mediterranean Sea. In between trips and pool parties, we challenged ourselves to exploit three vulnerabilities in three different categories: IoT, web, and binary exploitation.

Our first episode of the !exploitable series covers the Tenda AC15 CVE-2020-13393 Exploit

Blog post: https://blog.doyensec.com/2025/02/11/exploitable-iot.html
Exploit code: exploit.py

In this blog post we explore common vulnerabilities and misconfigurations affecting many OAuth implementations.
To help developers and security auditors, we are also releasing a cheat-sheet PDF containing popular OAuth flows and a security checklist for both server and client implementations.

Blog post: https://blog.doyensec.com/2025/01/30/oauth-common-vulnerabilities.html
Cheat sheet: Doyensec_OAuth_CheatSheet.pdf

In this post, we explore how to build polyglot JSON files to bypass file-upload restrictions. We used these files as gadgets when exploiting Client-Side Path Traversal (CSPT, CSPT2CSRF).

Blog post: https://blog.doyensec.com/2025/01/09/cspt-file-upload.html

We performed a vulnerability research activity targeting the SMB3 Kernel Server (ksmbd), a component of the Linux kernel. During our research, we identified multiple memory corruption related security issues, three of which are described in this post.

Article: https://blog.doyensec.com/2025/01/07/ksmbd-1.html

Our summer intern Michael worked on decompression attacks across different programming languages. The objective of the research was to identify, analyze, and detect vulnerable implementations in several popular programming languages used for web and app development, including - Python, Ruby, Swift, Java, PHP, and JavaScript.

Secure and insecure code, labs and Semgrep rules for all programming languages have been published on https://github.com/doyensec/Unsafe-Unpacking

For more details on this research project, please refer to https://blog.doyensec.com/2024/12/16/unsafe-unpacking.html

In this blog post we demonstrate how simple instrumentation can be used to automatically discover Client Side Path-Traversal (CSPT) primitives. By leveraging our own Eval Villain Firefox Add-On, we explain step by step on how to find vulnerability sinks. Even for learning new tricks using a playground, Eval Villain helps with debugging little mistakes.

https://blog.doyensec.com/2024/12/03/cspt-with-eval-villain.html

Download the PDF slides for Dennis Goodletts presentation on creating and reversing obfuscated python pickles.

CSPT Playground is a vulnerable application designed to learn, find and exploit various Client-Side Path Traversal (CSPT) vulnerabilities such as CSPT2CSRF (Client-Side Path Traversal to Cross-Site Request Forgery) and CSPT2XSS (Client-Side Path Traversal to Cross-Site Scripting). Various gadgets and sinks have been implemented within this app to showcase the potential risks and consequences of CSPT.

The code repository is available on our Github org: https://github.com/doyensec/CSPTPlayground

This research highlights the risks associated with class pollution in Ruby, especially when recursive merges are involved. These vulnerabilities are particularly dangerous because they allow attackers to escape the confines of an object and manipulate the broader application context. By understanding these mechanisms and carefully considering how data merges are handled, it is possible to mitigate the risk of class pollution in Ruby applications.

https://blog.doyensec.com/2024/10/02/class-pollution-ruby.html

Download the PDF slides for Francesco Lacerenza's Teleport Connect 2024 presentation on protecting your organization against an SSO IDP compromise.

A case study of how Doyensec was able to apply Security Engineering to help a client harden their platform against malicious attackers.

Learn some steps developers can take to prevent various attacks while still facilitating rich-media communications: https://blog.doyensec.com/2024/09/19/phishing-case-study.html

Thinkst engaged Doyensec to perform a security assessment of their OSS Canary Tokens.

The full technical deliverable for this engagement is now available: Doyensec_ThinkstCanaryTokensOSS_Report_Q22024.pdf

Doyensec discovered another vulnerability within the Windows Installer component. After months of processing, Microsoft did not acknowledge the bug, though we believe it can be leveraged for local privilege elevation. We are publishing a detailed analysis of how Custom Actions can be exploited, the potential security pitfalls, and steps to reproduce the attack.

Blog post describing our research and results: https://blog.doyensec.com/2024/07/18/custom-actions.html

We are introducing a new class of vulnerabilities named CSPT2CSRF. In fact, Client-Side Path Traversal can be leveraged to perform Cross-Site Request Forgery against modern and secure web applications. This research was presented last week by Maxence Schmitt at OWASP Global Appsec Lisbon 2024.

Slides: Doyensec_CSPT2CSRF_OWASP_Appsec_Lisbon.pdf
Whitepaper: Doyensec_CSPT2CSRF_Whitepaper.pdf
Tool: Burp Suite extension to find Client-Side Path Traversals

A look at potential impacts from an IdP compromise and Teleport hardening guidelines.

A side by side comparison of Product Security Audits and Bug Bounty Programs.

We took a look at three of the top software tools for examining software composition for vulnerabilities (SNYK, Semgrep, Dependabot). We compiled the results and have published a comprehensive whitepaper.

- Analysis blog post: https://blog.doyensec.com/2024/03/14/supplychain.html
- Whitepaper: Doyensec_Software_Composition_Analysis_Benchmark.pdf (PDF, EN)

Our latest research explores server-side Prototype Pollution gadgets. We developed a Burp Suite plugin to automatically detect and report these issues, marking a crucial step forward in detecting such class of vulnerabilities.

We are releasing a previously internal-only tool to improve Infrastructure as Code (IaC) analysis and enhance Visual Studio Code allowing real-time collaboration during manual code analysis activities.

- Release blog post: https://blog.doyensec.com/2024/01/30/poiex-release.html
- Repository: https://github.com/doyensec/PoiEx

Scheduling is often overlooked in Kubernetes designs. Nevertheless, a compromised pod could allow attackers to move laterally to other tenants running on the same Kubernetes node despite the other security measures.

Discover how a security-oriented scheduling strategy can help to reduce the blast radius of workload compromise in our latest blog post:

Zeal engaged Doyensec to perform a security assessment of the Zeal Wallet browser extension and backend.

The full technical deliverable for this engagement is now available: Doyensec_Zeal_SecurityReport_Q32023_v5_AfterRetest.pdf

InQL version 5 introduces significant enhancements and upgrades, solidifying its place as an indispensable tool for penetration testers and bug bounty hunters. This blog post explains the journey so far, and the future of the tool. At Doyensec, we're not just developing a tool, we're pushing the boundaries of what is possible in GraphQL security.

https://blog.doyensec.com/2023/08/17/inql-v5.html

Back in 2019, we were lucky enough to take part in the newly-launched Huawei mobile bug bounty. For that, we decided to research Huawei’s Themes. This blog post details an arbitrary code execution vulnerability having privileged app permissions: https://blog.doyensec.com/2023/07/26/huawei-theme-arbitrary-code-exec.html

Wsrepl is designed to simplify pentesting of websocket-based apps by offering an interactive REPL interface that is user-friendly, while also being conveniently easy to automate.

- Release blog post: https://blog.doyensec.com/2023/07/18/streamlining-websocket-pentesting-with-wsrepl.html
- Code: https://github.com/doyensec/wsrepl

GoTeleport engaged Doyensec to perform a security assessment of the Teleport core platform and cloud infrastructure. Teleport is a cloud-native gateway for managing access to clusters of servers, consolidating connectivity, authentication, authorization, and audit into a single platform.

The full technical deliverable for this engagement is now available: Doyensec_Gravitational_Teleport_Report_Q32022_WithRetesting.pdf

Doyensec discovered a vulnerability within the Windows Installer component of the Windows operating system. Exploiting this vulnerability by a local, unprivileged user could allow the disclosure of initialized or uninitialized memory in the process heap.

Microsoft security advisory: CVE-2023-32016

CloudSec Tidbits is a blogpost series showcasing interesting bugs found by Doyensec during cloud security testing activities. Each blogpost will discuss a specific vulnerability resulting from an insecure combination of web and cloud related technologies. Every article will include an Infrastructure as Code (IaC) laboratory that can be easily deployed to experiment with the described vulnerability.

- Episode 3 (post): https://blog.doyensec.com/2023/06/13/messing-around-with-aws-batch-for-privilege-escalations.html
- Episode 3 (code): https://github.com/doyensec/cloudsec-tidbits/tree/main/lab-batch

Download the presentation PDF file: Doyensec_Injecting_Malware_Into_Dating_Sims_Q22023.pdf

Read our blog post: https://blog.doyensec.com/2023/06/01/r2pickledec.html

Load the wrong save file into Doki Doki Literature Club and you will get rooted. Not just DDLC but any game made with Ren'Py. This talk we cover how to create, modify and reverse python pickles and what you can do with them.

As part of this talk we will be using r2pickledec, a Radare2 plugin we developed. This is the first pickle decompiler to support all pickle instructions (up to and including proto 5).

In this article we wrote about Understanding Zero Touch Production (ZTP) Platforms and Safe Proxies in DevSecOps. Here you'll learn about the security roles of Safe Proxies, common pitfalls, and what to look for when auditing ZTP tools/services.

Read more at: https://blog.doyensec.com/2023/05/04/testing-ztp-platforms-a-primer.html

We describe a web service which provides information about Ethereum Dapps, their domains and their smart contracts. It is used to give Dapp users more information about the Dapp they are using and help avoid potential scams.

Read more at: https://blog.doyensec.com/2023/03/28/wallet-info.html

Proof-of-Concept: https://github.com/doyensec/wallet-info

We're releasing the technical details of an interesting Server-Side Request Forgery (SSRF) vulnerability affecting NPM's request. Despite the fact that this package has been deprecated, this dependency is still used by over 50k projects with over 18M downloads per week. We demonstrated how an attacker can bypass any anti-SSRF mechanisms injected into this library by simply redirecting the request to another protocol (e.g. HTTP to HTTPS).

Our advisory: Doyensec_Advisory_RequestSSRF_Q12023.pdf

Blog post: https://blog.doyensec.com/2023/03/16/ssrf-remediation-bypass.html

Github pull request (fix): https://github.com/request/request/pull/3444

In this article we introduced a new uWSGI-based technique for the escalation from Arbitrary File Write (AFW) to Remote Code Execution (RCE) scenarios in web application uploads.

Read more at: https://blog.doyensec.com/2023/02/28/new-vector-for-dirty-arbitrary-file-write-2-rce.html

We're releasing the full technical details of a vulnerability affecting Caddy - a fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS. This vulnerability affects Caddy on Windows whereby an attacker could reveal hidden files by crafting a request using Alternate Data Stream or Short Names syntax.

Our advisory: Doyensec_Advisory_Caddy_Q42022.pdf

Caddy advisory: Official security advisory for Caddy < 2.6.3

Doyensec discovered a vulnerability within the Windows Installer component of the Windows operating system. A local, unprivileged user could exploit the installation routine to delete or create arbitrary files with the SYSTEM user privileges.

Microsoft security advisory: CVE-2023-21800

Blog post describing our research and results: https://blog.doyensec.com/2023/03/21/windows-installer.html

Proxy Enriched Sequence Diagrams (PESD) is our Burp Suite extension to visualize web traffic in a way that facilitates the analysis and reporting in scenarios with complex functional flows. While classic sequence diagrams for software engineering are meant for an abstract visualization and all the information is carried by the diagram itself, PESD is designed to include granular information related to the underlying HTTP traffic being represented in the form of explorable metadata.

- Release blog post: https://blog.doyensec.com/2023/02/14/pesd-extension-public-release.html
- Code: https://github.com/doyensec/PESD-Exporter-Extension

A remote attacker may be able to bypass SAML SSO authentication on a platform by exploiting CVE-2022-39299 affecting the passport-saml library. A public exploit was not available (at the time of writing), and the advisory was published on 10/12/2022 with little/no information. Doyensec developed a working Proof Of Concept (PoC) generator to verify the issue against multi-tenant platforms in which the tenant admin is able to configure SAML SSO with a custom IdP.

Code is available on our Github repository: https://github.com/doyensec/CVE-2022-39299_PoC_Generator

GoTeleport engaged Doyensec to perform a security assessment of the Teleport Desktop Access capabilities. Teleport is a cloud-native gateway for managing access to clusters of servers, consolidating connectivity, authentication, authorization, and audit into a single platform. The feature brings identity-based, passwordless RDP access to Windows hosts across all cloud, on-premises, and edge environments.

The full technical deliverable for this engagement is now available: Doyensec_Gravitational_TeleportRDP_Report_Q12022_WithRetesting.pdf

CloudSec Tidbits is a blogpost series showcasing interesting bugs found by Doyensec during cloud security testing activities. Each blogpost will discuss a specific vulnerability resulting from an insecure combination of web and cloud related technologies. Every article will include an Infrastructure as Code (IaC) laboratory that can be easily deployed to experiment with the described vulnerability.

- Episode 2 (post): https://blog.doyensec.com/2023/01/24/tampering-unrestricted-user-attributes-aws-cognito.html
- Episode 2 (code): https://github.com/doyensec/cloudsec-tidbits/tree/main/lab-cognito

The ImageMagick Security Policy Evaluator is an online tool that allows developers and security experts to check whether an XML Security Policy is hardened against a wide set of malicious attacks. It assists with the process of reviewing such policies, and helps identify best practices for ImageMagick deployments.

Read the release blog post: https://blog.doyensec.com/2023/01/10/imagemagick-security-policy-evaluator.html

GoTeleport engaged Doyensec to perform a security assessment of the Teleport core platform. Teleport is a cloud-native gateway for managing access to clusters of servers, consolidating connectivity, authentication, authorization, and audit into a single platform.

The full technical deliverable for this engagement is now available: Doyensec_Gravitational_Teleport_Report_Q12022_WithRetesting.pdf

Safeurl is a Go library created to help developers protect their applications from Server Side Request Forgery (SSRF) attacks. It implements a `safeurl.Client` wrapper around Go's native `net/http.Client` and performs validation on the incoming request against the configured allow and block lists. It also implements mitigation for DNS rebinding attacks.

Read the release blog post: https://blog.doyensec.com/2022/12/13/safeurl.html

Brave engaged Doyensec to perform a security assessment of the Brave Wallet, a multi-chain crypto wallet.

The full technical deliverable for this engagement is now available: Doyensec_BraveWallet_TestingReport_Q32022_AfterRetest.pdf

In this blog post, Doyensec's researcher Mohamed Ouad explores the Apache JServ Protocol version 1.3, and the infamous Ghostcat (CVE-2020-1938) vulnerability.

https://blog.doyensec.com/2022/11/15/learning-ajp.html

In this blog post, we explore how to exploit CVE-2021-26437 (Visual Studio Code .ipynb Jupyter Notebook XSS) to achieve remote code execution in VScode. A detailed technical description of the issue, together with a set of exploitation techniques and the full exploit are provided given that the issue has been patched for over one year.

https://blog.doyensec.com/2022/10/27/jupytervscode.html

Download the presentation PDF file: NoHat2022_Carettoni.pdf

At Doyensec, we have a traditional monthly event called "Best Bugs". Our security engineers and researchers showcase the most interesting security vulnerabilities that they have either discovered or helped exploit. For us this is a unique opportunity to share knowledge among team members, but there is more. Over the years, we realized how these bugs represent the current state of web application security. The progressive shift to SecDevOps and tech stacks that are secure-by-default have significantly changed the type of vulnerabilities and misconfigurations that affect mainstream web applications. Classic injection vulnerabilities are long gone in hard targets, and the new frontier of vulnerability research involves logical bugs, prototype pollution, API path traversal, broken state machines, second-order injections, misuse of libraries, inconsistencies between the application and the cloud infrastructure and many other modern approaches. In this presentation, we will showcase several of those bugs with the goal of both teaching individual techniques and vulnerabilities, as well as showing trends from the last couple of years.

CloudSec Tidbits is a blogpost series showcasing interesting bugs found by Doyensec during cloud security testing activities. Each blogpost will discuss a specific vulnerability resulting from an insecure combination of web and cloud related technologies. Every article will include an Infrastructure as Code (IaC) laboratory that can be easily deployed to experiment with the described vulnerability.

- Episode 1 (post): https://blog.doyensec.com/2022/10/18/cloudsectidbit-dataimport.html
- Episode 1 (code): https://github.com/doyensec/cloudsec-tidbits/tree/main/lab-dataimport

There are many security solutions available today that rely on the Extended Berkeley Packet Filter (eBPF) features of the Linux kernel to monitor kernel functions. Nowadays, eBFP-based programs are used for DDoS mitigations, intrusion detection, container security, and general observability. We audited one particular implementation, but eventually extended our research to techniques that can be generally applied to other targets while attempting to bypass any security monitoring solution based on eBPF: https://blog.doyensec.com/2022/10/11/ebpf-bypass-security-monitoring.html

We've put R2c’s Semgrep in a head-to-head test with GitHub’s CodeQL. Here are our results: https://blog.doyensec.com/2022/10/06/semgrep-codeql.html

Learn how various Electron API permissions could allow apps to spy on their users and what developers can do to protect them.

Read the full details on our research blog post: https://blog.doyensec.com/2022/09/27/electron-api-default-permissions.html

TypeORM is one of the most widespread ORM solutions, with more than a million weekly downloads. During one of our engagements, we discovered a critical vulnerability that involves prototype pollution and leads to SQL injection. Interestingly, this security bug turned out to be a regression.

Advisory with full technical details: Doyensec_Advisory_TypeORM_Q32022

Apollo GraphQL is the leader in open source and commercial GraphQL technologies. In May 2022, they engaged Doyensec to perform a security assessment of the Apollo Router, an OSS routing runtime for Apollo Federation.

The full technical deliverable for this engagement is now available: Doyensec_Apollo_Report_Q22022_v4_AfterRetest.pdf

GoProxy is a popular HTTP proxy library for Go, used as a dependency in many pieces of software. While auditing a Stripe-maintained fork of the libray (stripe/goproxy), we identified several Denial Of Service (DoS) vulnerabilities that could severely affect its availability. The issue also affected another widespread security-sensitive library, stripe/smokescreen, used to mitigate Server-Side Request Forgery (SSRF) attacks.

Advisory with full technical details: Doyensec_Advisory_SmokescreenGoProxy_Q12022.pdf

We're now releasing the full technical details of a Server-Side Request Forgery (SSRF) vulnerability affecting Gibbon - a wrapper for MailChimp API 3.0 and Export API. By leveraging this vulnerability an attacker can gain information about the local system, internal network, and potentially machines in neighbor networks. The ability to issue arbitrary requests to internal endpoints may also cause unwanted interactions with internal systems.

Our advisory: Doyensec_Advisory_Gibbon_Q12022.pdf

Github advisory: GHSA-vx9g-377x-xwxq

The default landing page contained HTML to display a sample curl command which is made visible if the full landing page bundle could not be fetched from Apollo's CDN. The server's URL is directly interpolated into this command inside the browser from window.location.href. On some older browsers such as IE11, this value is not URI-encoded. On such browsers, opening a malicious URL pointing at an Apollo Router/Server could cause execution of attacker-controlled JavaScript.

Apollo Server advisory: GHSA-2fvv-qxrq-7jq6

Apollo Router advisory: GHSA-p5q6-hhww-f999

Given the end of the embargo, we're releasing the technical details of a DOM-based Cross-Site Scripting (XSS) vulnerability affecting AnnounceKit that was discovered by one of our senior researchers during a client's engagement.

Our advisory: Doyensec_Advisory_AnnounceKit_Q12022.pdf

This research focused on creating an all-around tool (named Confuser) to test and exploit potential Dependency Confusion vulnerabilities in the wild. The tool allows scanning packages.json files, generating and publishing payloads to the NPM repository, and finally aggregating the callbacks from vulnerable targets. To validate the effectiveness, we looked for potential Dependency Injection vulnerabilities in top ElectronJS applications.

Article: https://blog.doyensec.com/2022/07/21/dependency-confusion.html

Tool: https://github.com/doyensec/confuser

GoTeleport engaged Doyensec to perform a security assessment of several new Teleport platform features, including Advanced Access Workflows, Slack and Mattermost Plugins, and the Terraform Provider.

The full technical deliverable for this engagement is now available: teleport-features-audit-q3-2021.pdf

During a client engagement we decided to spend a few hours to evaluate the overall security posture of the Open Policy Agent (OPA).

OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. OPA is a graduated project in the Cloud Native Computing Foundation (CNCF). Leveraging advanced fuzzing techniques, we identified two Denial of Services vulnerabilities affecting the "Every" expression and CompileModules. Both issues trigger an out-of-range memory access, and do not seem exploitable for remote command execution.

Link to the Incorrect Parsing Of "Every" Expression advisory: resources/Doyensec_Advisory_OPA_Q32022_1.pdf
Link to the Incorrect Interface Conversion Via CompileModules advisory: resources/Doyensec_Advisory_OPA_Q32022_2.pdf

Kafka Connect is a tool for reliably streaming data between Apache Kafka and other data systems. Once Kafka Connect is initialized, with any supported connector property configuration in standalone or distributed mode, port 8083 serves the REST API to the Kafka Connect cluster. By default, the API is accessible in an unauthenticated manner unless authentication is specifically configured. A default instantiation of the Kafka Connect cluster would allow an attacker to configure an environment with the FileStreamSource connector and then read files directly from the Connect server, with the same user privileges and context as the Connect process itself. Similarly, the FileStreamSink connector could also be leveraged to perform arbitrary file writes to the file system in its default unauthenticated state.

Link to the public PDF advisory: Doyensec_Advisory_KafkaConnect_FileReadWrite.pdf

GoTeleport engaged Doyensec to perform a security assessment of several new Teleport platform features, including BPF-based Restricted Session, Simplified Node Joining for AWS, Account Life-cycle: Recovery and Cancellation, Hardware security module (HSM) support, and ThalesIgnite's crypto11 library for PKCS#11.

The full technical deliverable for this engagement is now available: teleport-features-audit-q4-2021.pdf

This article will help pentesters use their familiarity with classic database systems such as Postgres and MariaDB, and apply it to Apache Pinot. In this post, we will show how a classic SQL-injection (SQLi) bug in a Pinot-backed API can be escalated to Remote Code Execution (RCE) and then discuss post-exploitation.

Article: https://blog.doyensec.com/2022/06/09/apache-pinot-sqli-rce.html

This article introduces VirtualBox vulnerability research and explains how to build a coverage-based fuzzer, focusing on the emulated network device drivers. We provide all the necessary steps and code required to instrument and debug the latest stable version of VirtualBox.

Article: https://blog.doyensec.com/2022/04/26/vbox-fuzzing.html

Code: https://github.com/doyensec/vbox-fuzz

Basecamp engaged us to perform a broad application review of HEY. The project consisted of a manual application security assessment against HEY’s web platform and its APIs, mobile (Android, iOS) and desktop (ElectronJS-based) applications. The security audit summary (SAS) for this engagement is now available.

The findings include a number of information exposure vulnerabilities, insecure design, and security misconfiguration issues found across the three HEY clients and the main API service, in addition to several medium severity findings affecting the multi-factor authentication mechanism (2FA bypass), the Gopher caching service (Server Side Request Forgery, Stored Cross-Site Scripting) and the Android mobile application (Insecure File Content Provider). We also demonstrate how chaining three vulnerabilities discovered during this engagement would allow an attacker to compromise the user’s workstation when using HEY for Desktop.

Download the HEY audit summary deliverable: Doyensec_Basecamp_HEY_PlatformTesting_Q32020_SAS.pdf

GraphQL is getting more popular every day. Despite that, it is not immune to Cross-Site Request Forgery attacks. We spent the last few weeks testing a variety of GraphQL frameworks and applications to understand how widespread this issue is.

Read the full story on our blog: https://blog.doyensec.com/2021/05/20/graphql-csrf.html

GoTeleport engaged Doyensec to perform an in-depth security assessment of the Teleport Cloud platform. From their technical blog post:

The full technical deliverable for this engagement is now available.

Download the Teleport Cloud testing deliverable: teleport-cloud-audit-q1-2021.pdf

Pritunl-client-electron is a free and open source cross platform OpenVPN client. Doyensec discovered two local privilege escalation issues. Due to insufficient configuration sanitization, a low-privileges attacker can obtain root level access. These vulnerabilities were fixed in version v1.2.2768.85.

Link to the public PDF advisory: Doyensec_Advisory_Pritunl_Client_Q22021.pdf

GoTeleport engaged Doyensec to perform an in-depth security assessment of the Teleport product. The full technical deliverable for this engagement is now available.

Download the Teleport testing deliverable: teleport-audit-q4-2020.pdf

During our research on ReDoS, Doyensec reported several vulnerabilities:

• CVE-2020-5243: uap-core affecting uap-python, uap-ruby, etc. (User-Agent header parsing)
• CVE-2020-8492: cpython’s urllib.request (WWW-Authenticate header parsing)
• CVE-2021-21236: CairoSVG (SVG parsing)
• CVE-2021-21240: httplib2 (WWW-Authenticate header parsing)
• CVE-2021-25292: python-pillow (PDF parsing)
• CVE-2021-26813: python-markdown2 (Markdown parsing)
• CVE-2021-27290: npm/ssri (SRI parsing)
• CVE-2021-27291: pygments lexers for ADL, CADL, Ceylon, Evoque, Factor, Logos, Matlab, Octave, ODIN, Scilab & Varnish VCL (Syntax highlighting)
• CVE-2021-27292: ua-parser-js (User-Agent header parsing)
• CVE-2021-27293: RestSharp (JSON deserialisation in a .NET C# package)
• bpo-38804: cpython’s http.cookiejar (Set-Cookie header parsing)
• SimpleCrawler (archived) (HTML parsing)
• Plus many more unpublished bugs in a handful of pypi, npm, ruby and nuget packages. We will update this list on Regexploit's Github page.

In this blog post, we’re releasing a new tool to analyse regular expressions and hunt for ReDoS vulnerabilities. Our heuristic has been proven to be extremely effective, as demonstrated by many vulnerabilities discovered across popular NPM, Python and Ruby dependencies.

Read the full story on our blog: https://blog.doyensec.com/2021/03/11/regexploit.html

Regexploit - a tool to find regular expressions which are vulnerable to ReDoS. Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain non-matching input strings can make the regular expression matcher go into crazy backtracking loops and take ages to process. This can cause denial of service, as the CPU will be stuck trying to match the regex.

This tool is designed to:
• find regular expressions which are vulnerable to ReDoS
• give an example malicious string which will cause catastrophic backtracking

Download the latest release from Regexploit's Github releases page

ElectronJs is getting more secure every day. Context isolation and other security settings are planned to become enabled by default with the upcoming release of Electron 12 stable, seemingly ending the somewhat deserved reputation of a systemically insecure framework.

From an attacker’s perspective, Electron-specific APIs are very often the easiest path to gain remote code execution, read or write access to the host’s filesystem, or leak sensitive user’s data. Malicious JavaScript running in the renderer can often subvert the application using such primitives.

Read the full story on our blog: https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html

CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files for Rails, Sinatra and other Ruby-based web frameworks. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This vulnerability was fixed in versions 1.3.2 and 2.1.1.

Link to the public Github Advisory: GHSA-fwcm-636p-68r5

The npm package ansi_up converts ANSI escape codes (used by terminal emulators to, for example, set text color) into HTML. Since ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, extra HTML attributes and javascript code can be injected into the returned HTML. This can be used in a Cross-Site Scripting (XSS) attack. This vulnerability was fixed in v5.0.0.

Download the advisory PDF file: Doyensec_Advisory_ansi_up4_XSS.pdf

During a customer engagement, Doyensec discovered a Certificate Validation vulnerability affecting the node-sass package, used for the Node.js bindings to libsass. Because of an optional flag misconfiguration, libsass binaries fetched from the official github.com CDN may be tampered in-transit. Versions 2.0.0 to 4.14.1 are affected.

Doyensec researched mobile P2P Wi-Fi protocols and their obscure file-sharing implementations. As a result, an overlooked problem common to every Android vendor-provided solution was identified.

Read the full story on our blog: https://blog.doyensec.com/2020/12/10/novel-abuses-wifi-direct-mobile-file-transfers.html

A new major release of InQL, our GraphQL security testing tool, is out! This release includes a Cycles Detector, Request Timer, Precise Query Generation and many bug fixes.

Read more on our blog: https://blog.doyensec.com/2020/11/19/inql-scanner-v3.html

As part of our fuzzing initiatives, we worked on a few techniques to target popular JavaScript engines (JSE). Our research resulted in a contribution to the well known fuzzer "Fuzzilli". By integrating Fuzzilli with JerryScript, Doyensec was able to identify multiple security vulnerabilities over the course of just four weeks.

Read more on our latest blog post: https://blog.doyensec.com/2020/09/09/fuzzilli-jerryscript.html

This blog post illustrates a vulnerability affecting the Play Framework that we discovered during a client engagement. This issue allows a complete Cross-Site Request Forgery (CSRF) protection bypass under specific configurations.

Read more on the blog: https://blog.doyensec.com/2020/08/20/playframework-csrf-bypass.html

During a customer engagement, Doyensec discovered a CSRF Protection Bypass vulnerability affecting the Play Framework. If a black list is used, the result is that a malicious user may be able to perform a CSRF attack on the Play application.

A frequently-updated repository with presentations, bug write-ups, and all kinds of content to help during Electron security testing and hacking.

You can find it over at doyensec/awesome-electronjs-hacking.

A new version of InQL, our GraphQL security testing tool, is out! This release includes a new stand-alone UI, which integrates an embedded GraphiQL server and many other features.

Read more on the blog: https://blog.doyensec.com/2020/06/11/inql-scanner-v2.html

We are building a flexible ASN.1 grammar-based fuzzer for testing TLS certificate parsers. In this blog post, we introduce our research and provide references for security practitioners that are interested in the topic.

Find more details at https://blog.doyensec.com/2020/05/14/asn1fuzz.html

Google Scholar was found to be vulnerable to multiple stored XSS using an exotic technique involving polymorphic images. In this blog post, we explain the bug found and all the possible ways to create and leverage polymorphic images for XSS through a survey of how popular image manipulation libraries in web apps behave when presented with a polymorphic image.

Find more details at https://blog.doyensec.com/2020/04/30/polymorphic-images-for-xss.html

Download the presentation PDF file: Doyensec_InQL_AB_Github.pdf

Given the rising popularity of GraphQL in web applications, Andrea Brancaleoni presented a turbo-talk on GraphQL security and the use of InQL to augment manual security testing.

A different pick on bounty programs. Discover how to participate in securing free and open source software, while leveraging your blue team skills. In one of our early research projects we ported libressl to OSS-fuzz, a Google sponsored fuzzer infrastructure for open source projects.

Find more details at https://blog.doyensec.com/2020/04/08/libressl-fuzzer.html

During a customer engagement, Doyensec discovered a path traversal vulnerability affecting the Next.js framework. Attackers could craft special requests to access files in the dist directory (.next), leading to the disclosure of source code and application's secrets. This issue affects Next.js below 9.3.2, when executed using next start

Release note: https://github.com/zeit/next.js/releases/tag/v9.3.2

InQL Scanner is security testing tool to facilitate GraphQL technology security auditing efforts. The tool can be used as a stand-alone script, or as a Burp Suite extension.

Download the latest release from InQL's Github releases page

Doyensec discovered a Code Execution vulnerability in Microsoft Visual Studio Code Python Extension (16.5M+ installations at the time of writing).

Find more details and the Proof of Concept in our blogpost: https://blog.doyensec.com/2020/03/16/vscode_codeexec.html

In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's filesystem, given their path, without restrictions on the requester's origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.

Original Theia Bug Tracker issue: https://bugs.eclipse.org/bugs/show_bug.cgi?id=551747
PR of the fix: https://github.com/eclipse-theia/theia/pull/7205

During a targeted security research effort on the Django Framework, Doyensec discovered that GIS functions and aggregates on Oracle were subject to a SQL injection, using a suitably crafted tolerance parameter.

Gravitational engaged Doyensec to perform an in-depth security assessment of the Teleport and Gravity enteprise products. Quoting Gravitational's engineers: "This year, we had an opportunity to work with Doyensec, which provided the most thorough independent analysis of Gravity and Teleport to date."

Download the Teleport testing deliverable PDF file: Doyensec_Gravitational_Teleport_Report_Q22019_WithRetesting.pdf
Download the Gravity testing deliverable PDF file: Doyensec_Gravitational_Gravity_Report_Q22019_WithRetesting.pdf

This blog post illustrates a vulnerability we discovered in the popular electron-builder package: a signature validation bypass in the auto-update mechanism could be abused to push malicious updates and execute arbitrary code on the victims' machine. In this blog post, we explain the details of the vulnerability and demonstrate why such fail-open designs are inherently dangerous for security.

Link: https://blog.doyensec.com/2020/02/24/electron-updater-update-signature-bypass.html

Download the deliverable PDF file: Doyensec_SoloKeys_TestingReport_Q12020_v3.pdf

SoloKeys engaged Doyensec to perform a security assessment of the SoloKeys software components. The project commenced on January 20, 2020, and ended on January 31, 2020, requiring one security researcher. The audit resulted in three (3) findings of which one (1) was rated as high severity.

The final deliverable, Proof-of-Concept exploits and our instrumentation for AFL fuzzing have been publicly released.

This blog post illustrates a vulnerability we discovered in the F-Secure Internet Gatekeeper application. It shows how a simple mistake can lead to an exploitable unauthenticated remote code execution vulnerability.

Link: https://blog.doyensec.com/2020/02/03/heap-exploit.html

Download the presentation PDF file: Covalence-2020-Carettoni-DemocratizingElectronSecurity.pdf

We love Electron.js so much, that we break it. Since 2017, we have audited dozens of Electron-based applications and witnessed a remarkable commitment to security. Back then, breaking the framework’s security mechanisms wasn’t too difficult. Fast forward to 2020, Electron.js is getting better, secure-by-default settings are slowly becoming the norm, vulnerability disclosure is handled with consolidated practices, and the dev community is gradually learning all common pitfalls.

It is better, but there is still a long road ahead. Responsibilities must be equally shared between core contributors and application developers. While the most effective way to bring security capabilities to everyone is to have them built into the framework, it is also important to have a community that considers security as a core value. Closing the web-native desktop gap is not trivial as we have to balance security with usability and framework flexibility.

In this talk we want to celebrate the progress made and discuss the technical challenges that both Electron.js maintainers and application developers are facing when building secure desktop applications. We will show common vulnerabilities and misconfigurations, discuss root causes and provide practical tips on how to mitigate existing attacks. If you care about Electron.js security, this talk is for you!

Download the presentation PDF file: Villamil-Modern-Web-Security-Assertions.pdf

Modern web security is a mix of relatively recent frameworks, methods, languages, and abstractions. The age of injection bugs has come and gone. We are firmly in the age of assertions. This age is widely defined by business logic flaws. On a deeper level this age is governed by the security auditor's skill in creating and breaking assertions in the target. Assertions come from any source and they represent statements of security or functionality made by the target.

We'll talk about our experience auditing modern web applications over the last three years. We'll talk about the current state of web application security, how its evolved, and where its going. We give examples of assertions (big and small) created and broken during various security audits and the value this brought to the customer. Our goal is to introduce the age of assertions into the zeitgeist and provide auditors a more refined way of thinking beyond injection bugs.

Doyensec discovered that an old Android vulnerability involving the `FLAG_SECURE` setting still affected popular mobile password managers for Android (1Password, Keeper, Dashlane, et al).

The article showcases the vulnerabilities found and explains the common underlying problem.

Link: https://blog.doyensec.com/2019/08/22/modern-password-managers-flag-secure.html

The "Cookie" handling class, responsible for validating the signature of a cookie value through the "extractSignedContent" function, is vulnerable to PHP Type Confusion.

Matomo Github's PR: https://github.com/matomo-org/matomo/pull/14760

Download the presentation PDF file: Electronegativity_ArsenalBHUS2019.pdf

Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications.

This is the first and only tool capable of detecting potential weaknesses and implementation bugs when developing applications using Electron, as recommended in the official security guidelines of the Electron project. Software developers and security auditors can use this tool to create secure desktop applications using web technologies.

After being first introduced at Black Hat US 2017 (Electronegativity - A Study of Electron Security) and featured at Black Hat Asia 2019 (Preloading Insecurity In Your Electron), the tool was showcased for the first time ever at the Black Hat USA 2019 Arsenal where we demonstrated its potential by scanning well-known applications.

In the past three years, Doyensec has been providing security testing services for some of the global brands in the cryptocurrency world. We have audited desktop and mobile wallets, exchanges web interfaces, custody systems, and backbone infrastructure components.

We have seen many things done right, but also discovered many design and implementation vulnerabilities. Failure is a great lesson in security and can always be turned into positive teaching for the future. Learning from past mistakes is the key to create better systems.

Link: https://blog.doyensec.com/2019/08/01/common-crypto-bugs.html

In this article, we explore a Jackson deserialization bug (CVE-2019-12384) discovered during one of our engagements. In particular, we illustrate how an attacker may leverage this deserialization vulnerability to trigger Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE) using a new technique that relies on the popular JDBC/H2 library.

Link: https://blog.doyensec.com/2019/07/22/jackson-gadgets.html

After the first public release of Electronegativity, we had a great response from the community and the tool quickly became the baseline for every Electron app’s security review for many professionals and organizations. This pushed us forward, improving Electronegativity and expanding our research in the field. Today we are proud to release version 1.3.0 with many new improvements and security checks for your Electron applications.

Link: https://blog.doyensec.com/2019/06/11/electronegativity-1.3.html

During one of our projects we had the opportunity to audit a Ruby-on-Rails (RoR) web application handling zip files using the Rubyzip gem. Zip files have always been an interesting entry-point to triggering multiple vulnerability types, including path traversals and symlink file overwrite attacks. As the library under testing had symlink processing disabled, we focused on path traversal exploitation.
This blog post discusses our results, the “bug” discovered in the library itself and the implication of such an issue in a popular piece of software - Metasploit.

Link: https://blog.doyensec.com/2019/04/24/rubyzip-bug.html

We’re back from BlackHat Asia 2019 where we introduced a relatively unexplored class of vulnerabilities affecting Electron-based applications.
Despite popular belief, secure-by-default settings are slowly becoming the norm and the dev community is gradually learning common pitfalls. Isolation is now widely deployed across all top Electron applications and so turning XSS into RCE isn’t child’s play anymore.

Link: https://blog.doyensec.com/2019/04/03/subverting-electron-apps-via-insecure-preload.html

Download the presentation PDF file: Asia-19-Carettoni-Preloading-Insecurity-In-Your-Electron.pdf

Modern browsers are complicated systems. They enforce numerous security mechanisms to ensure isolation between sites, facilitate web security protections and preventing untrusted remote content to compromise the security of the host. When working with Electron (https://electronjs.org/), things get even more complicated.

The good news is that building secure Electron-based desktop applications is possible. Despite popular belief, the average Electron-based app is more secure than the average web application. The framework itself is getting better, secure-by-default settings are slowly becoming the norm and the dev community is gradually learning all common pitfalls.

It's time to shift gears. In this presentation, we will discuss a relatively unexplored class of vulnerabilities that can turn a boring XSS into RCE. Even without a framework bug (e.g. nodeIntegration bypass), BrowserWindow preload introduces a new interesting attack surface to Electron-based applications.

Abusing Electron's internal IPC, loggers and other application components we will show how we can turn a Cross-Site Scripting vulnerability into a reliable exploitation mechanism to fully compromise popular desktop applications.

We're excited to announce the public release of Electronegativity, an opensource tool capable of identifying misconfigurations and security anti-patterns in Electron-based applications.
Electronegativity is the first-of-its-kind tool that can help software developers and security auditors to detect and mitigate potential weaknesses in Electron applications.

Link: https://blog.doyensec.com/2019/01/24/electronegativity.html

Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. Electronegativity is the first-of-its-kind tool that helps software developers and security auditors to detect and mitigate potential weaknesses in Electron applications; it is now the baseline for every Electron app’s security review for many professionals and organizations.

Download the source and binary from electronegativity's Github page

Since the first commit back in 2016, burp-rest-api has been the default tool for BurpSuite-powered web scanning automation. Many security professionals and organizations have relied on this extension to orchestrate the work of Burp Spider and Scanner.
Today, we’re proud to announce a new major release of the tool: burp-rest-api v2.0.1.
Starting in June 2018, Doyensec joined VMware in the development and support of the growing burp-rest-api community. After several years of experience in big tech companies and startups, we understand the need for security automation to improve efficacy and efficiency during software security activities. Unfortunately internal security tools are rarely open-sourced, and still, too many companies are reinventing the wheel. We believe that working together on foundational components, such as burp-rest-api, represents the future of security automation as it empowers companies of any size to build customized solutions.

Link: https://blog.doyensec.com/2018/11/05/burp-rest-api-v2.html

A vulnerability affects the /saml/auth endpoint of the saml_idp Ruby library (<= v0.7.2) during the processing of SAML requests. The AssertionConsumerServiceURL field is not properly validated. An attacker can abuse this issue to leak the full SAML response or even perform account takeover.

saml-idp Github's PR: https://github.com/saml-idp/saml_idp/pull/102

Download the presentation PDF file: A-Drone-Tale-by-Paolo-Stagno-SEC-T.pdf

Drones have increased their field of application and are actively used across various industries (law enforcement and first responders, utility companies, governments and universities) to perform critical operations on a daily basis. As a result of that, security has also become a crucial aspect when operating remote-controlled pilotless aircrafts. This talk provides a comprehensive overview of the security model and security issues affecting a popular consumer drone product: the DJI Phantom 3.

With the increasing popularity of the Electron Framework, we have created this post to summarize a few techniques which can be used to instrument an Electron-based application, change its behavior, and perform in-depth security assessments.

Link: https://blog.doyensec.com/2018/07/19/instrumenting-electron-app.html

As part of an engagement for one of our clients, Doyensec analyzed the patch for the recent Electron Windows Protocol handler RCE bug (CVE-2018-1000006) and identified a bypass.

Under certain circumstances this bypass leads to session hijacking and remote code execution. The vulnerability is triggered by simply visiting a web page through a browser. Electron apps designed to run on Windows that register themselves as the default handler for a protocol and do not prepend dash-dash in the registry entry are affected.

More details in our blog post: https://blog.doyensec.com/2018/05/24/electron-win-protocol-handler-bug-bypass.html

As part of an engagement for one of our clients, we analyzed the patch for the recent Electron Windows Protocol handler RCE bug (CVE-2018-1000006) and identified a bypass.
Under certain circumstances this bypass leads to session hijacking and remote code execution. The vulnerability is triggered by simply visiting a web page through a browser. Electron apps designed to run on Windows that register themselves as the default handler for a protocol and do not prepend dash-dash in the registry entry are affected.
We reported the issue to the Electron core team (via security@electronjs.org) on May 14, 2018 and received immediate notification that they were already working on a patch. The issue was also reported by Google’s Nicolas Ruff a few days earlier.

Link: https://blog.doyensec.com/2018/05/24/electron-win-protocol-handler-bug-bypass.html

With the increasing popularity of GraphQL technology, in this blog post we are summarizing some documentation and tips about common security mistakes.

Link: https://blog.doyensec.com/2018/05/17/graphql-security-overview.html

burp-rest-api is a REST/JSON API to the Burp Suite security tool. Since the first commit back in 2016, burp-rest-api has been the default tool for BurpSuite-powered web scanning automation. Many security professionals and organizations have relied on this extension to orchestrate the work of Burp Spider and Scanner. Starting in June 2018, Doyensec joined VMware in the development and support of the growing burp-rest-api community.

Download the source and binary from burp-rest-api's Github page

Spotlight is the all pervasive seeing eye of the OSX userland. It drinks from a spout of file events sprayed out of the kernel and neatly indexes such things for later use. It is an amalgamation of binaries and libraries, all neatly fitted together just to give a user oversight of their box. It presents interesting attack surface and this blog post is an explanation of how some of it works.

Link: https://blog.doyensec.com/2017/11/15/osx-spotlight.html

Doyensec researchers discovered a bug in Apple's macOS ATS. Parsing a malicious font file will result in memory corruption and information leakage.

Apple's original advisory: https://support.apple.com/en-us/HT208144

Doyensec researchers discovered a bug in Apple's macOS Font Importer. Parsing a malicious font file will result in memory corruption and information leakage.

Apple's original advisory: https://support.apple.com/en-us/HT208221

An XXE vulnerability was identified in Apache Commons Jelly by Doyensec researchers. During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks.

Apache Commons' original advisory: http://commons.apache.org/proper/commons-jelly/security-reports.html#CVE-2017-12621

An arbitrary file retrieval vulnerability was identified in QNAP QTS 4.3.3 File Manager. This functionality can be abused to download arbitrary files from the NAS filesystem as root, leading to system compromise.

Download the advisory PDF file: Doyensec_Advisory_QNAPQTS4.3_FileRetrieval.pdf

Doyensec theme for the Hopper Disassembler - chill and functional for long RE nights.

Download Doyensec.hopperTheme and import the file through the Preferences menu.

At the recent Black Hat Briefings 2017, Doyensec’s co-founder Luca Carettoni presented a new research on Electron security. After a quick overview of Electron’s security model, we disclosed design weaknesses and implementation bugs that can be leveraged to compromise any Electron-based application. In particular, we discussed a bypass that would allow reliable Remote Code Execution (RCE) when rendering untrusted content (for example via Cross-Site Scripting) even with framework-level protections in place.
In this blog post, we would like to provide insight into the bug (CVE-2017-12581) and remediations.

Link: https://blog.doyensec.com/2017/08/03/electron-framework-security.html

Download the whitepaper PDF file: us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security-wp.pdf

This document introduces a checklist of security anti-patterns and must-have features to illustrate misconfigurations and vulnerabilities in Electron-based applications. Software developers and security auditors can benefit from this document as it provides a concise, yet comprehensive, summary of potential weaknesses and implementation bugs when developing applications using Electron.

Download the presentation PDF file: us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security.pdf

Despite all predictions, native Desktop apps are back. After years porting stand-alone apps to the web, we are witnessing an inverse trend. Many companies have started providing native desktop apps built using the same technologies as their web counterparts. In this trend, Github's Electron has become a popular framework to build cross-platform desktop apps with JavaScript, HTML, and CSS. While it seems to be easy, embedding a webapp in a self-contained web environment (Chromium, Node.Js) introduces new security challenges. In this presentation, we will illustrate Electron's security model and describe current isolation mechanisms to prevent untrusted content from using Node.js primitives. Electron's IPC messaging, preloading and other internals will be comprehensively discussed. BrowserWindow and WebView security-relevant options will be also analyzed, together with design-level weaknesses and implementation bugs in Electron.

An information leakage vulnerability (out-of-bounds read) was discovered in Apple's CoreText, which could allow an attacker to disclose the process memory. This issue could facilitate further exploitation.

Download the advisory PDF file: Doyensec_Advisory_FontParsingOSX.pdf

An information leakage vulnerability (out-of-bounds read) was discovered in Apple's FontParser, which could allow an attacker to disclose the process memory. This issue could facilitate further exploitation.

Download the advisory PDF file: Doyensec_Advisory_FontParsingOSX.pdf

A memory corruption vulnerability was identified in a core component of Apple's font parsing - CoreText. Through a malicious True Type Collection (ttc) font file, CoreText will enter a loop unintentionally referencing out of bounds memory.

Download the advisory PDF file: Doyensec_Advisory_FontParsingOSX.pdf

A memory corruption vulnerability was identified in a core component of Apple's font parsing - CarbonCore. This issue could allow an attacker to execute code during the parsing of a malicious Datafork TrueType font.

Download the advisory PDF file: Doyensec_Advisory_FontParsingOSX.pdf

Download the presentation PDF file: Application_Security_Recipes_for_Fast-Paced_Environments.pdf

Ensuring the security of web applications in continuous delivery environments is an open challenge for many organizations. In fast-paced environments (e.g. startups, agile SDLC shops, etc.), traditional application security practices can slow continuous delivery or simply not address security at all. Instead, a new approach based on security automation and tactical security testing is required to make sure that important components are tested before going live. In this presentation, I will illustrate a few examples on how Silicon Valley-based startups approach security testing while seeking the perfect balance between compliance, security and business productivity.

libajp13 is a fully featured open source library implementing the Apache JServ Protocol version 1.3 (ajp13), based on the Apache Protocol Reference. Thanks to libajp13, it is now possible to craft properly formatted AJP binary packets with a single line of code.

Download the source and binary from libajp13's Github page

AJPFuzzer is a rudimental fuzzer for the Apache JServ Protocol, also known as 'ajp13'. Built on top of libajp13, the tool allows you to create and send AJP messages using an easy-to-use command line interface. AJPFuzzer can craft properly formatted AJP13 messages (all message types) as well as mutations (e.g. bit flipping, messages with type mismatch, etc.), which facilitates security testing efforts targeting AJP-based services like web servers AJP modules, J2EE containers, and many others.

Download the source and binary from AJPFuzzer's Github page

We have open-sourced the repository containing the templates and code for the training "Developing Burp Suite Extensions - From Manual Testing to Security Automation".

The repository is accessible at https://github.com/doyensec/burpdeveltraining