Web & API Security

SMTP Smuggling: Spoofing Email With Authenticated Mail

Post author:Hmmnm
Post published:December 19, 2023
Post category:Security Web & API Security

December 2023 brought one of email's most elegant attacks: SMTP smuggling, a parser-level desync that tricks receiving servers into writing attacker-authored messages that pass SPF and DMARC because the victim's own infrastructure vouches for them. This deep dive covers the technique mechanics (end-of-data ambiguity, the second hidden MAIL FROM conversation), the December 19 disclosure and DHL demonstration, the two anchoring CVEs, which product families patched, and the durable lessons for mail admins running anything that speaks SMTP.

LockBit, CitrixBleed, and the ICBC Treasury Hack

Post author:Hmmnm
Post published:November 11, 2023
Post category:Ransomware & Malware Security Web & API Security

When LockBit hit ICBC's US broker-dealer on 9 November 2023, Treasury-market connectivity went dark and manual settlement took over for days. The entry path traced to CitrixBleed session tokens stolen before the October patch and never invalidated — exactly what CISA's Emergency Directive 23-08 had warned. LockBit claimed a roughly $9 million ransom demand, never verified. The post walks the token-replay kill chain, the disclosure-era aftermath, and the defensive lesson that remediation includes revocation.

F5 BIG-IP Request Smuggling 2023: The 9.8 Desync

Post author:Hmmnm
Post published:October 19, 2023
Post category:Cloud & Infrastructure Security Web & API Security

CVE-2023-46747 let unauthenticated attackers smuggle requests through BIG-IP TMM into the iControl REST management plane — a framing bug that became full device compromise. Exploitation followed the October patch within days, and CISA put it on the KEV catalog before month end.

CitrixBleed CVE-2023-4966: Session Tokens Straight From Memory

Post author:Hmmnm
Post published:October 10, 2023
Post category:Cloud & Infrastructure Security Web & API Security

CVE-2023-4966 let attackers read valid session tokens out of NetScaler memory and inherit authenticated sessions wholesale — MFA already passed. CISA's Emergency Directive 23-08 forced hunts and rebuilds as LockBit monetized the access.

Cisco BroadWorks CVE-2023-20237: The SSO Bypass Scare

Post author:Hmmnm
Post published:September 18, 2023
Post category:Cloud & Infrastructure Security Web & API Security

In September 2023 Cisco rushed out patches for CVE-2023-20237, a critical authentication bypass in BroadWorks' single-sign-on flows that could let attackers authenticate as any user. With evidence of active scanning, carrier admins ran an emergency patch marathon.

WebP BlastPass: One C Library Pwned Everything

Post author:Hmmnm
Post published:September 7, 2023
Post category:Identity & Phishing Security Web & API Security

CVE-2023-4863, a heap overflow in libwebp's Huffman decoding, let the BLASTPASS chain install Pegasus via a zero-click iMessage image — and forced every browser, OS, and Electron app on earth to patch the same line of C.

WinRAR’s 19-Year-Old Bug: When Legacy Code Turns Lethal

Post author:Hmmnm
Post published:August 23, 2023
Post category:Security Web & API Security

CVE-2023-38831 let a crafted WinRAR archive execute attacker code off a decoy file click — and researchers proved APT campaigns had been exploiting the 2004-era parser flaw for months before the August 2023 fix.

Citrix NetScaler CVE-2023-3519: Breached Before the Advisory

Post author:Hmmnm
Post published:July 18, 2023
Post category:Cloud & Infrastructure Security Web & API Security

The July 2023 NetScaler ADC/Gateway pre-auth RCE hit government networks as a true zero-day — and post-patch webshell persistence taught defenders that appliance remediation means rebuild, not upgrade.

MOVEit’s Ledger: 2,700 Orgs, 93 Million People

Post author:Hmmnm
Post published:June 14, 2023
Post category:Security Supply Chain Security Web & API Security

Cl0p's June 2023 listing waves turned the MOVEit breach into a running census — 2,700+ organizations and ~93M individuals per Emsisoft tallies. The economics of encryption-free extortion.

Barracuda ESG Hack: When Patching Isn’t Enough

Post author:Hmmnm
Post published:June 4, 2023
Post category:Cloud & Infrastructure Security Web & API Security

CVE-2023-2868 gave pre-auth RCE in Barracuda's email gateways via spreadsheet parsing, exploited since October 2022. The final verdict: replace every appliance. Remediation doctrine lessons.

MOVEit Transfer Zero-Day: Cl0p’s Memorial Day Heist

Post author:Hmmnm
Post published:May 27, 2023
Post category:Security Supply Chain Security Web & API Security

CVE-2023-34362 in MOVEit Transfer let Cl0p deploy the LEMURLOOT web shell at scale over Memorial Day weekend — pure data extortion, no encryption, hundreds of downstream victims.

Papercut RCE 2023: Print Servers as the Softest Door

Post author:Hmmnm
Post published:April 19, 2023
Post category:Cloud & Infrastructure Security Web & API Security

CVE-2023-27350 gave unauthenticated RCE on PaperCut MF/NG servers across schools and hospitals, with access handed toward ransomware crews.