Tessera
Folgen

pspaul

@pspaul95.bsky.social

9 Posts75 Follower134 Folgt
pspaul@pspaul95.bsky.social · 2mo ago

A fun gadget I found recently! The .NET JIT compiler makes sure there are no rwx pages by using a memfd, but that turns file writes into straight shellcode execution 🐚

SonarResearch@sonarresearch.bsky.social · 2mo ago

Shellcode execution as a service! To exploit an argument injection in Jellyfin, we searched and found a gadget in the .NET runtime to turn file writes into code execution. Learn about the bug and this new technique in our blog post: www.sonarsource.com/blog/jellyfi... #appsec #vulnerability

SonarResearch@sonarresearch.bsky.social · 4mo ago

📱 1-click RCE in the YTDLnis Android app! On Android, turning file writes into RCE is usually quite hard, but here the app had a nice gadget for us. Check out the details in our latest blog post: www.sonarsource.com/blog/ytdlnis... #appsec #security #vulnerability

From intent extra to RCE: Argument injection in YTDLnis

Discover a vulnerability our researchers found in the Android app YTDLnis, allowing attackers to execute code on victim devices.

sonarsource.com

pspaul@pspaul95.bsky.social · 9mo ago

This was pretty fun to exploit! Even though I didn't manage to pwn the version used for Pwn2Own Berlin, I still learned a ton about LLMs. Maybe I can get my revenge in future competitions 🤞

SonarResearch@sonarresearch.bsky.social · 9mo ago

From bit flip to RCE in Ollama! 🦙 Our latest blog post explains how a file parsing bug led to an interesting out-of-bounds write primitive. Learn how it could have been exploited in Ollama, a tool to run LLMs locally: www.sonarsource.com/blog/ollama-... #security #vulnerability #llm #ai

SonarResearch@sonarresearch.bsky.social · last yr.

🔓⏫ After compromising every endpoint within an organization, our “Caught in the FortiNet” blog series comes to an end with one more thing. Read more about FortiClient's XPC mistake that allows local privilege escalation to root on macOS: www.sonarsource.com/blog/caught-... #appsec #security

Caught in the FortiNet: How Attackers Can Exploit FortiClient to Compromise Organizations (3/3)

In the last blog of this series, we will focus back on FortiClient and learn how the inner workings of this application work, and what crucial mistake happened that led to us uncovering a local privil...

sonarsource.com

SonarResearch@sonarresearch.bsky.social · last yr.

📁🫷🚧Can't control the extension of a file upload, but you want an XSS? Read more on how we overcame this obstacle to further exploit entire organizations using Fortinet endpoint protection: www.sonarsource.com/blog/caught-... #appsec #vulnerability #bugbountytips

Caught in the FortiNet: How Attackers Can Exploit FortiClient to Compromise Organizations (2/3)

We recently discovered critical vulnerabilities in Fortinet’s endpoint protection solution that enable attackers to fully compromise organizations with minimal user interaction. In this second article...

sonarsource.com

pspaul@pspaul95.bsky.social · last yr.

Great bug chain by my team mate Yaniv that can pwn a whole org, starting with a single user click! I was also able to contribute a bit by creating my first port of a Chrome n-day exploit :)

SonarResearch@sonarresearch.bsky.social · last yr.

🕸️🏢Caught in the FortiNet: Exploiting Fortinet’s endpoint protection solution to compromise an entire organization using minimal user interaction. Dive into our technical analysis of this interesting attack scenario: www.sonarsource.com/blog/caught-... #appsec #security #vulnerability

SonarResearch@sonarresearch.bsky.social · last yr.

Catch our second talk at #TROOPERS25: 🕸️ Caught in the FortiNet: Compromising Organizations Using Endpoint Protection Yaniv Nizry will tell you the story of multiple vulnerabilities in Fortinet products that can compromise an entire organization, starting with a single click

Bild
pspaul@pspaul95.bsky.social · last yr.

This was a fun one to discover! SQL syntax can be ambiguous, and MySQL anticipated this a long time ago. Other SQL dialects stuck to the spec, leading to SQL injection when the right stars align:

SonarResearch@sonarresearch.bsky.social · last yr.

SQL Injection despite using prepared statements? 🧐 Turns out that SQL syntax can be ambiguous! Learn how this has led to vulnerabilities in several popular PostgreSQL client libraries: www.sonarsource.com/blog/double-... #appsec #security #vulnerability