Web & API Security

Read more about the article PAN-OS GlobalProtect Zero-Day: CVE-2024-3400 Explained

PAN-OS GlobalProtect Zero-Day: CVE-2024-3400 Explained

On April 12, 2024, WatchTowr disclosed CVE-2024-3400 — a CVSS 10.0 pre-auth command injection in PAN-OS GlobalProtect that state-sponsored actors had exploited since late March by chaining a cookie-controlled file write into Tcl execution as root. This account walks the two-flaw exploit chain, the scramble after the 10.2.9-h1 hotfix, CISA’s KEV clock, config-hidden persistence that survived reboots, the mitigation-versus-remediation confusion, and why 2024 made appliances patch with server-grade urgency.

Continue ReadingPAN-OS GlobalProtect Zero-Day: CVE-2024-3400 Explained
Read more about the article JetBrains TeamCity Auth Bypass: Build Servers as Front Door

JetBrains TeamCity Auth Bypass: Build Servers as Front Door

March 2024’s CVE-2024-27198 let unauthenticated attackers mint admin accounts on self-hosted TeamCity CI servers, converting every connected build agent into attacker-controlled execution holding source, secrets and signing keys. This piece covers the alternate-path authentication bypass, the companion path traversal, the ransomware crews that queued within days, and the year’s hard-learned rule that build infrastructure deserves domain-controller-grade security.

Continue ReadingJetBrains TeamCity Auth Bypass: Build Servers as Front Door
Read more about the article ConnectWise ScreenConnect Auth Bypass: An Instant RCE Wave

ConnectWise ScreenConnect Auth Bypass: An Instant RCE Wave

February 2024’s CVE-2024-1709 let anyone add administrative accounts to self-hosted ScreenConnect servers — a setup-wizard path traversal that converted remote-support consoles into ransomware deployment platforms within 72 hours of disclosure. This account covers the twinned vulnerabilities, why MSP-hosted instances multiplied the blast radius across client fleets, the observed ransomware sequences, and the hard questions RMM vendors faced about unauthenticated wizard endpoints.

Continue ReadingConnectWise ScreenConnect Auth Bypass: An Instant RCE Wave
Read more about the article Ivanti Connect Secure Zero-Days: The Edge-Appliance Crisis

Ivanti Connect Secure Zero-Days: The Edge-Appliance Crisis

January 2024 opened with the year’s first appliance crisis: two pre-authentication zero-days in Ivanti Connect Secure that nation-state actors had already exploited, followed by integrity-check failures and a reset wave across thousands of enterprise VPNs. This account covers CVE-2023-46805 and CVE-2024-21887, the mass exploitation between disclosure and patch, the customers whose breaches surfaced weeks later, and why edge appliances became the year’s most contested patch surface.

Continue ReadingIvanti Connect Secure Zero-Days: The Edge-Appliance Crisis
Read more about the article SMTP Smuggling: Spoofing Email With Authenticated Mail

SMTP Smuggling: Spoofing Email With Authenticated Mail

December 2023 brought one of email’s most elegant attacks: SMTP smuggling, a parser-level desync that tricks receiving servers into writing attacker-authored messages that pass SPF and DMARC because the victim’s own infrastructure vouches for them. This deep dive covers the technique mechanics (end-of-data ambiguity, the second hidden MAIL FROM conversation), the December 19 disclosure and DHL demonstration, the two anchoring CVEs, which product families patched, and the durable lessons for mail admins running anything that speaks SMTP.

Continue ReadingSMTP Smuggling: Spoofing Email With Authenticated Mail
Read more about the article LockBit, CitrixBleed, and the ICBC Treasury Hack

LockBit, CitrixBleed, and the ICBC Treasury Hack

When LockBit hit ICBC’s US broker-dealer on 9 November 2023, Treasury-market connectivity went dark and manual settlement took over for days. The entry path traced to CitrixBleed session tokens stolen before the October patch and never invalidated — exactly what CISA’s Emergency Directive 23-08 had warned. LockBit claimed a roughly $9 million ransom demand, never verified. The post walks the token-replay kill chain, the disclosure-era aftermath, and the defensive lesson that remediation includes revocation.

Continue ReadingLockBit, CitrixBleed, and the ICBC Treasury Hack
Read more about the article F5 BIG-IP Request Smuggling 2023: The 9.8 Desync

F5 BIG-IP Request Smuggling 2023: The 9.8 Desync

CVE-2023-46747 let unauthenticated attackers smuggle requests through BIG-IP TMM into the iControl REST management plane — a framing bug that became full device compromise. Exploitation followed the October patch within days, and CISA put it on the KEV catalog before month end.

Continue ReadingF5 BIG-IP Request Smuggling 2023: The 9.8 Desync