Top 10 Web Hacking Techniques

2023

The 2023 Top 10 Web Hacking Techniques: all 10 winners and 93 nominated and collected techniques, each with its researcher, summary and preserved source.

93 records · 10 in the top ten · open this year in the interactive archive

The top ten

#1 Smashing the state machine: the true potential of web race conditions James Kettle
Web race conditions reach far beyond limit overrun: every HTTP request passes through hidden sub-states, so two requests landing in the same millisecond can force illegal state transitions, such as confirming an email…
#2 Exploiting Hardened .NET Deserialization Piotr Bazydło
Shows how to keep exploiting .NET deserialization sinks that vendors hardened with type allow-lists and binders: new gadgets in product code and third-party libraries, arbitrary getter-call chains, and abuse of insecure…
#3 SMTP Smuggling - Spoofing E-Mails Worldwide Timo Longin
Outbound and inbound SMTP servers disagree on which byte sequence ends message data, so a sequence such as LF dot CRLF passes one server unfiltered and is read as end-of-data by the next. An attacker with any account at…
#4 PHP filter chains: file read from error-based oracle Rémi Matasse
PHP filter chains are stacked so an iconv conversion inflates a file until the memory limit aborts the request, while a dechunk filter drops the data when the leading byte is a hex digit. Whether the error fires is a…
#5 Exploiting HTTP Parsers Inconsistencies Rafael da Costa Santos
A survey of parsing disagreements between proxies and backends. Characters that Node.js, Flask and Spring strip from a request path but Nginx keeps let an attacker slip past location-based ACLs. Header line folding…
#6 HTTP Request Splitting vulnerabilities exploitation Sergey Bobrov
nginx configurations that put normalized URI variables into proxy_pass, rewrite or forwarded headers let an attacker inject CRLF and split the request sent to the backend, adding headers, changing method and path, or…
#7 How I Hacked Microsoft Teams and got $150,000 in Pwn2Own @kinugawamasato and Masato Kinugawa
Three Microsoft Teams (Electron 1.x) bugs chained into zero-click remote code execution: a wildcard-allowed CSS class smuggles an AngularJS ng-init expression into a chat message for XSS, the main window's missing…
#8 From Akamai to F5 to NTLM... with love. @deadvolvo and d3d
Space-prefixed Content-Length smuggling gadgets pass through Akamai Edge unnormalised and are then cached by the F5 BIG-IP behind it, so repeated requests poison the cache globally. Smuggling an absolute-URL request…
#9 Cookie Crumbles: Breaking and Fixing Web Session Integrity Marco Squarcina, Pedro Adão, Lorenzo Veronese and Matteo Maffei
Studies cookie integrity across browsers and server frameworks and shows that the Secure attribute, cookie prefixes, SameSite and synchronizer CSRF tokens can be composed or implemented in ways that still allow session…
#10 can I speak to your manager? hacking root EPP servers to take control of zones Sam Curry, Brett Buerhaus, Rhys Elsmore and Shubham Shah
EPP servers used by domain registries, most of them running CoCCA registry software, parsed XML with external entities enabled, giving unauthenticated file read on port 700. Chained with a path traversal in an…

Also collected

A New Vector For “Dirty” Arbitrary File Write to RCE Maxence Schmitt and Lorenzo Stella
uWSGI parses any file that contains a uwsgi section header as a configuration file, and its exec magic variable runs a shell command while doing so. An attacker with only partial control of written file contents, here a…
A Security Study about Electron Applications and a Programming Methodology to Tame DOM Functionalities Zihao Jin, Shuo Chen, Yang Chen, Haixin Duan, Jianjun Chen and Jianping Wu
Real-world Electron desktop apps inherit web injection bugs, letting attacker-supplied content reach DOM sinks and escalate into local-machine exploitation. The authors report vulnerabilities confirmed by vendors and…
Adobe ColdFusion RCE Harsh Jaiswal and Rahul Maini
Analyzes ColdFusion deserialization and successive patch bypasses, including an alternative WDDX gadget and inconsistent validation of array type names. The July 2023 writeup distinguishes the initial vulnerability from…
AWS WAF Bypass: invalid JSON object and unicode escape sequences @AndreaTheMiddle and Andrea Menin
AWS WAF can only inspect a request body as plain text or JSON, and its default handling of a body it considers invalid JSON is to let the request through unexamined. Repeating a JSON key with a harmless value first and…
AWS WAF Clients Left Vulnerable to SQL Injection Due to Unorthodox MSSQL Design Choice Marc Olivier Bergeron and @GoSecure_Inc
MSSQL accepts stacked statements with no semicolon and no whitespace between them, which AWS WAF's SQL parser treated as invalid and let through. Appending an exec() payload to an injectable parameter bypassed the WAF…
Azure B2C Crypto Misuse and Account Compromise Justin Copeland and @praetorianlabs
Azure AD B2C custom policies follow Microsoft's own tutorial in encrypting OAuth refresh tokens under an RSA key, but RSA encrypts with the public half, which is not a secret. An attacker who recovers that public key…
BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover Hillai Ben-Sasson
Azure AD multi-tenant applications that switch on built-in authentication but never check the tenant claim let any Azure account sign in, and about 25 percent of scanned multi-tenant apps were affected. Wiz used it…
Blind CSS Exfiltration: exfiltrate unknown web pages Gareth Heyes
With only CSS injected into a page whose structure the attacker cannot see, attribute selectors combined with :has and :not on the html element, CSS variable fallbacks and multiple backgrounds, and @import chaining let…
Bypass firewalls with of-CORs and typo-squatting Chris Grayson
Shows that internal corporate web apps often enable wildcard CORS without authentication, and that an attacker can reach them by registering typo variants of a company's internal domain. A mistyped visit registers a…
Chained to hit: Discovering new vectors to gain remote and root access in SAP Enterprise Software Pablo Artuso and Yvan Genuer
Maps SAP's proprietary P4 protocol and reports 13 unauthenticated flaws in the JNDI services it exposes: SQL injection, arbitrary OS file read, blind SSRF with header injection and code execution in Solution Manager…
Checking Passwords on Leaky Computers: A Side Channel Analysis of Chrome's Password Leak Detect Protocol Andrew Kwong, Walter Wang, Jason Kim, Jonathan Berger, Daniel Genkin, Eyal Ronen, Hovav Shacham, Riad Wahby and Yuval Yarom
Analyses Chrome's password leak detection protocol and shows the implementation leaks through microarchitectural side channels in its scrypt hashing, hash-to-elliptic-curve step and modular inversion, letting an…
CoCo: Efficient Browser Extension Vulnerability Detection via Coverage-guided, Concurrent Abstract Interpretation Jianjia Yu, Song Li, Junmin Zhu and Yinzhi Cao
CoCo interprets a browser extension abstractly but concurrently, one thread per branch, callback and message channel, scheduled to maximise code coverage, so it resolves dynamic JavaScript lookups prior tools missed. It…
Code Vulnerabilities Put Proton Mails at Risk Paul Gerste
Proton Mail renamed sanitized svg elements to proton-svg after DOMPurify ran, moving the subtree from SVG to HTML parsing rules so a closing style sequence hidden in an attribute re-parsed into a live img onerror…
Code Vulnerabilities Put Skiff Emails at Riskr Paul Gerste
Skiff's webmail inserted a div into the already-sanitized DOM inside an svg element; because a div is not a valid svg child, re-serializing and re-parsing the HTML moved the style element out of SVG context, so an img…
Compromising F5 BIGIP with Request Smuggling Justin Copeland and @praetorianlabs
F5 BIG-IP fronts its Tomcat TMUI backend with a custom Apache httpd vulnerable to AJP request smuggling: a Transfer-Encoding of chunked, chunked makes httpd drop Content-Length and emit the POST body as a second AJP…
Cookie Bugs - Smuggling & Injection Ankur Sundara
Java and Python web servers parse the Cookie header differently from browsers. Several still honour RFC2965 quoted strings, so a double quote in one cookie value swallows the cookies after it and can leak an HttpOnly…
Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework Soroush Dalili
Repeating the ASP.NET cookieless session token inside a URL path, or appending it after the file extension as PathInfo, makes the framework strip path segments after IIS has already applied its rules. That reaches…
Cracking the Odd Case of Randomness in Java joseph
A meet-in-the-middle attack recovers the 48-bit state of java.util.Random from a handful of outputs of nextInt with an odd bound, splitting the LCG equation into upper and lower state halves and matching candidates…
CVE-2022-4908: SOP bypass in Chrome using Navigation API Johan Carlsson and @joaxcar
Chrome's Navigation API copied navigation.entries() from the previous document when a window or frame was navigated to about:blank, so a same-site but cross-origin page could read the target window's full history URLs…
DiffCSP: Finding Browser Bugs in Content Security Policy Enforcement through Differential Testing Seongil Wi, Trung Tin Nguyen, Jihwan Kim, Ben Stock and Sooel Son
A differential testing framework generates policies together with every known way of executing JavaScript in HTML, runs each combination across browsers, and uses a decision tree to explain the inconsistencies. It found…
DNS Analyzer - Finding DNS vulnerabilities with Burp Suite Timo Longin
A Burp Suite extension that uses Burp Collaborator interactions to measure the UDP source port and DNS ID randomness of the resolver a web application uses, flagging resolvers still predictable enough for a Kaminsky…
DOM-based race condition: racing in the browser for fun - RyotaK's Blog RyotaK
Libraries such as AngularJS bind their attributes only after the page has loaded, so HTML pasted into a contenteditable element before the library script runs is later evaluated as a template expression and gives XSS…
DOMLeakify: style-attribute ID-existence timing oracle arkark
Five SECCON challenge writeups include DOMLeakify: injected style attributes use Firefox -moz-element() to make costly rendering conditional on a secret DOM ID, exposing it through timing. Other challenges combine…
draw.io CVEs @caioluders
Two draw.io flaws found by source review: the /proxy endpoint's blocklist of private hosts is defeated by http://0:8080/, giving SSRF; and an isAbsolute check returns false when URI parsing throws, so the malformed…
EmojiDeploy: Smile! Your Azure web service just got RCE’d Liv Matan
Azure's Kudu SCM service, which backs App Service, Functions and Logic Apps, sets SameSite=None on its session cookies and guards requests with an origin regex that a wildcard-DNS host of the form…
Exploiting ASP.NET TemplateParser — Part I Markus Wulftange
The ASP.NET Web Forms TemplateParser, fed attacker-controlled markup through ParseControl, instantiates arbitrary types with a public parameterless constructor and drives arbitrary property setters along property paths…
Extending a Hand to Attackers: Browser Privilege Escalation Attacks via Extensions Young Min Kim and Byoungyoung Lee
Shows the browser extension architecture imposes security requirements developers struggle to meet, so the boundary between a privileged extension component and its page-facing content script can be crossed. Fifty-nine…
Fashion Faux Pas: Implicit Stylistic Fingerprints for Bypassing Browsers' Anti-Fingerprinting Defenses Xu Lin, Frederico Araujo, Teryl Taylor, Jiyong Jang and Jason Polakis
StylisticFP fingerprints a browser and device using only CSS: sized iframes, media queries and element layouts reveal fonts, operating system, browser and screen properties through dimensions alone, so no JavaScript API…
Fileless Remote Code Execution on Juniper Firewalls VulnCheck
A single environment-variable manipulation flaw in Juniper SRX and EX J-Web devices is turned into unauthenticated remote code execution that writes nothing to disk: PHP is made to read its configuration from the CGI…
Finding All Cross-Site Needles in the DOM Stack Jörg Schwenk, Marcus Niemietz, Christian Mainka, Lukas Knittel and Dominik Trevor Noß
AutoLeak turns a page's runtime DOM into a directed graph in each of two user states and diffs the two graphs, enumerating every property and object a cross-origin attacker can observe. Across 151,776 generated test…
From an Innocent Client-Side Path Traversal to Account Takeover Nadir's Blog
A client-side path traversal in a single-page app's fetch URL lets an attacker steer the request elsewhere on the API host, then chain it to an OAuth error redirect registered with an attacker-controlled redirect_uri…
fuzzuli musana
fuzzuli builds its wordlist from the target's own domain instead of a static list, generating variants with dots removed, vowels stripped and subdomains reversed or shuffled, then probing for backup archives; it finds…
Generating deserialization payloads for MessagePack C#’s Typeless mode Dane Evans
Builds MessagePack Typeless payloads by serializing a surrogate object graph and replacing cached type names with the intended assembly-qualified names. The article explains limitations of serialization hooks and gadget…
Hacking into gRPC-Web Amin Nasiri
How to attack gRPC-Web without the .proto file: strip the five-byte length prefix from the base64 body, decode the Protobuf with Protoscope, edit fields by number and re-encode using the author's gRPC Coder tool and…
Hijacking OAuth Code via Reverse Proxy for Account Takeover Omid Rezaei
Shows an OAuth authorization code leaking through a same-origin image proxy. A state-controlled redirect retains an accepted callback prefix while traversing into the proxy route, which forwards the appended code to an…
How to break SAML if I have paws? Aleksei "GreenDog" Tiurin
A practical attack methodology for SAML single sign-on. It fingerprints an implementation from the SAMLRequest and metadata, forges a SAMLResponse from scratch, and defeats signature validation through missing Signature…
HTML Over the Wire Ryan
HTML-over-the-wire frameworks such as Hotwire Turbo, HTMX and Unpoly intercept link clicks and expose fetch features through plain HTML attributes, so an injected link can issue a POST and carry attacker-chosen headers.
Hunting for Nginx Alias Traversals in the wild Daniel (Celesian) Matsumoto
An Nginx location prefix without a trailing slash combined with an alias directive that ends in one concatenates everything after the matched prefix onto the alias path, so a request to /img../ escapes the served…
Introducing wrapwrap: using PHP filters to wrap a file with a prefix and suffix blog.lexfo.fr
PHP filter chains could already prepend arbitrary bytes to a resource; by padding the base64, swapping quartets with UCS-4 to UCS-4LE conversions and truncating with the dechunk filter, wrapwrap also appends an…
Isolated and Exhausted: Attacking Operating Systems via Site Isolation in the Browser Matthias Gierlings, Marcus Brinkmann and Jörg Schwenk
Shows that site isolation, by giving web content its own operating system processes, hands a mere web attacker OS-level resources to exhaust: a visited page can fork-bomb the machine and occupy every UDP socket, and…
It's (DOM) Clobbering Time: Attack Techniques, Prevalence, and Defenses Soheil Khodayari
Injecting plain non-script HTML whose id or name attribute collides with an undefined JavaScript variable or a native DOM API makes the browser hand the program an attacker-controlled element object, turning markup into…
Java Exploitation Restrictions in Modern JDK Times codewhitesec.blogspot.com
With Nashorn removed in Java 15, ScriptEngineManager payloads stop working, so this uses the JShell API with fully qualified class names to run arbitrary Java in-process without spawning a child process. It also shows…
JMX Exploitation Revisited codewhitesec.blogspot.com
Two default JMX MBean classes give instant remote code execution on any reachable JMX endpoint, needing no application-specific MBeans and no callback connection. StandardMBean wraps an arbitrary serializable object…
Leaking more than log₂ of the URL count with the selectURL gate anisenoff
Shared Storage worklets delay selected-URL requests according to stored values, leaking information through server-observed timing even when a single URL incurs zero budget cost. Later comments demonstrate conditional…
Leaking Secrets From GitHub Actions: Reading Files And Environment Variables, Intercepting Network/Process Communication, Dumping Memory karimrahal.com
Turns a command injection in a GitHub Actions workflow into full secret disclosure: reading the expanded .sh files the runner writes under _temp, dumping the environment of Node.js action processes, and most reliably…
Memcached Command Injections at Pylibmc btlfry.gitlab.io
Flask-Session builds its memcached key by concatenating a prefix with the session cookie value, so CRLF smuggled in through octal-quoted cookie escapes injects raw memcached commands. An attacker can store an arbitrary…
Metamask Snaps: Playing in the Sand Bruno Halltari and Caue Obici
MetaMask Snaps run untrusted extension code behind an isolated iframe, LavaMoat and Secure ECMAScript, with an RPC allow-list deciding which wallet methods a snap may call. The article documents a permission bypass…
mTLS: When certificate authentication is done wrong Michael Stepankin
Implementation flaws in mutual-TLS client authentication: servers that scan the whole certificate chain instead of only the first entry let an attacker impersonate another user with a self-signed certificate (Keycloak)…
MyBB Admin Panel RCE CVE-2023-41362 blog.sorcery.ie
MyBB's admin panel rejects templates containing executable PHP syntax, but the check runs a preg_replace first and never inspects its return value. A template padded with thousands of array-index repetitions blows the…
Navigating Murky Waters: Automated Browser Feature Testing for Uncovering Tracking Vectors Mir Masood Ali, Binoy Chitale, Mohammad Ghasemisharif, Chris Kanich, Nick Nikiforakis and Jason Polakis
CanITrack automatically exercises browser storage, cache, access-control and policy mechanisms by writing and reading state across different browsing contexts to see what persists. Testing 21 mechanisms uncovered…
New ways of breaking app-integrated LLMs Kai Greshake
Demonstrates indirect prompt injection against application-integrated LLMs: instructions hidden in a web page, email or source file that the model retrieves become commands, letting an attacker remote-control the…
nOAuth: How Microsoft OAuth Misconfiguration Can Lead to Full Account Takeover Omer Cohen
Azure AD lets a tenant admin set an arbitrary, unverified email address on a user, and that value is emitted as the email claim in the OpenID Connect token. Any application that identifies users by the email claim…
OAuth 2.0 Redirect URI Validation Falls Short, Literally Tommaso Innocenti, Matteo Golinelli, Kaan Onarlioglu, Ali Mirheidari, Bruno Crispo and Engin Kirda
The OAuth 2.0 rule to compare redirect_uri by simple string comparison guards only the domain, so appended path-confusion payloads and injected duplicate code parameters still pass validation, at 6 and 10 of 16 major…
Oh-Auth - Abusing OAuth to take over millions of accounts Aviad Carmel
Sites that accept a social-login access token frequently never verify which application the token was minted for. An attacker who harvests Facebook tokens on an innocuous site of their own can replay them into Vidio…
One Scheme to Rule Them All: OAuth Account Takeover Mohamed Benchikh
A malicious mobile app registers the custom URL scheme a legitimate app uses as its OAuth redirect_uri, so the authorization grant issued for that app's client_id is delivered to the attacker and the victim's account is…
One Supply Chain Attack to Rule Them All Adnan Khan and adnanthekhan
A fork pull request can seize a non-ephemeral self-hosted GitHub Actions runner attached to a public repository: a one-character typo fix makes the attacker a contributor and clears the default approval gate, and the…
Pretalx Vulnerabilities: How to get accepted at every conference Stefan Schiller
The HTML schedule export in the pretalx conference system builds filesystem paths straight from URLs found in user-uploaded content, giving an arbitrary file read (CVE-2023-28459) and, through a URL-encoding difference…
Prototype Pollution in Python blog.abdulrah33m.com
Prototype pollution has a Python equivalent: a recursive merge or a pydash set_ call that walks attacker-supplied keys onto an object reaches special attributes such as __class__, __base__, __globals__ and…
PwnAssistant - Controlling /home’s via a Home Assistant RCE Joseph Surin and Victor Kahan
Audits Home Assistant’s authentication exceptions and traces proxy requests through route matching, decoding and URL normalization. Double-decoding, whitespace-removal and trusted-header variants expose Supervisor APIs…
QUICforge: Client-side Request Forgery in QUIC Yuri Gbur and Florian Tschorsch
QUIC's design lets a client with a spoofed source address make a server send attacker-shaped UDP datagrams to a third host, through server initial packets, version negotiation or connection migration.
Ransacking your password reset tokens positive.security
Rails applications that hand an unfiltered q parameter to the Ransack library expose search matchers such as start and matches over attributes of associated records, turning a search box into a boolean oracle. An…
RCE via LDAP truncation on hg.mozilla.org joernchen
Mozilla's hg.mozilla.org SSH shell passed a user-supplied e-mail address into an LDAP filter after stripping quotes and parentheses. An encoded null byte truncated the LDAP query so the filter still matched, while the…
RøB: Ransomware over Modern Web Browsers Harun Oz, Ahmet Aris, Abbas Acar, Güliz Seray Tuncay, Leonardo Babun and Selcuk Uluagac
Demonstrates that the browser File System Access API combined with WebAssembly is enough to build ransomware that runs as an ordinary web application, encrypting a visitor's local files including cloud-synced…
Scaling JavaScript Abstract Interpretation to Detect and Exploit Node.js Taint-style Vulnerability Mingqing Kang, Yichao Xu, Song Li, Rigel Gjomemo, Jianwei Hou, V.N. Venkatakrishnan and Yinzhi Cao
FAST scales JavaScript abstract interpretation with a bottom-up pass that resolves dynamic call edges and Promise chains per scope, and a top-down pass that interprets only statements the sink depends on, then solves…
Second Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET Jonathan Birch
A serializer can be made to emit data that deserializes into a different type than was serialized: a dictionary key named like its type specifier, such as __type or $type, is written verbatim and read back as a type…
Server-side prototype pollution: Black-box detection without the DoS Gareth Heyes
Server-side prototype pollution in Node and Express can be found black box without the usual denial of service, by polluting properties that cause safe, reversible response changes such as JSON spacing, CORS exposed…
Source Code at Risk: Critical Code Vulnerability in CI/CD Platform TeamCity Stefan Schiller
TeamCity excluded any path matching the wildcard /**/RPC2 from all global request interceptors, which is where its authorization check lives, so any URL ending in /RPC2 was served unauthenticated. An undocumented REST…
SSO Gadgets: Escalate (Self-)XSS to ATO Lauritz Holtmann
OAuth2/OIDC clients that still permit the implicit flow, omit PKCE, or run as public single-page apps give an attacker with script execution on the app's origin a way to mint a fresh access_token through a prompt=none…
SSRF Cross Protocol Redirect Bypass Szymon Drosdzol
The Node.js request library deletes the custom HTTP agent whenever a redirect switches protocol, which silently discards the anti-SSRF filter attached to that agent. An attacker-controlled open redirect from HTTPS to…
State of DNS Rebinding in 2023 Roger Meyer
A 2023 status report on DNS rebinding: Chrome's Local Network Access protection is bypassed by targeting 0.0.0.0, which reaches localhost services on Linux and macOS in about three seconds, or by reaching a router's…
SynthDB: Synthesizing Database via Program Analysis for Security Testing of Web Applications An Chen, Jiho Lee, Basanta Chaulagain, Yonghwi Kwon and Kyu Hyung Lee
Dynamic scanners miss vulnerable code in database-backed PHP applications because those paths are only reachable when the database holds the right data. SynthDB uses concolic execution to learn the constraints linking…
The GitHub Actions Worm: Compromising GitHub Repositories Through the Actions Dependency Tree @PaloAltoNtwks and Asi Greenholts
GitHub Actions can depend on other actions through action.yml and through the workflows that build them, forming a dependency tree mapped here across the Marketplace. Code running in a job can read the runner's memory…
The Leaky Web: Automated Discovery of Cross-Site Information Leaks in Browsers and the Web Jannis Rautenstrauch, Giancarlo Pellegrino and Ben Stock
An automated framework drives Chromium, Firefox and WebKit over a large space of crafted HTTP responses and browser APIs, summarising the results as decision trees, and finds 280 cross-site observation channels plus 11…
Thirteen Years On: Advancing the Understanding of IIS Short File Name (SFN) Disclosure! Soroush Dalili
Extends the IIS 8.3 short-file-name disclosure technique: response differences to crafted tilde and wildcard requests confirm hidden files and folders, and extra question-mark padding also reveals full long file names…
Three New Attacks Against JSON Web Tokens Tom Tervoort
Three JWT library flaws: a token encrypted to the public half of a signing key pair is accepted as authentic, a JSON-serialized JWS smuggles unsigned claims past a validator that splits the token on dots, and a PBES2…
Tricks for Reliable Split-Second DNS Rebinding in Chrome and Safari intruder.io
Delaying the A response makes Safari load an attacker's public IPv6 host first and then switch to the private IPv4 target; Chrome's preference for public IPv6 over private IPv4 plus a connection reset does the same, so…
tRPC Security Research: Hunting for Vulnerabilities in Modern APIs Borna Nematzadeh
A testing methodology for tRPC APIs: fingerprint the style from its GET-query and POST-mutation procedure paths, batch parameter and error shapes; locate exposed trpc-panel documentation by dorking and fuzzing to read…
Uncovering a crazy privilege escalation from Chrome extensions @deryilz
On ChromeOS a Chrome extension holding only the downloads permission can save an HTML file and open it through a filesystem:chrome://file-manager/external URL, running script on the privileged File Manager origin.
Uncovering and Exploiting Hidden APIs in Mobile Super Apps Chao Wang, Yue Zhang and Zhiqiang Lin
Mobile super apps such as WeChat, WeCom, Baidu, QQ and TikTok expose undocumented bridge APIs to the miniapps that run inside them, and many carry no permission check. A static-plus-dynamic tool, APIScope, recovers…
Unserializable, but unreachable: Remote code execution on vBulletin blog.lexfo.fr
A pre-authentication unserialize sits in vBulletin's ORM, where an array field is validated by deserialising it. No in-tree gadget works because every vBulletin class blocks wakeup, so the researchers deserialise a fake…
XSS in GMAIL Dynamic Email asdqw3
Gmail's AMP for Email sanitizer could be escaped from inside a style amp-custom block: the parser acted on an unterminated closing style tag and auto-generated closing tags, letting injected markup break into the…
Yelp ATO via XSS + Cookie Bridge lil_endian
Chains a self-XSS in Yelp's unverified-email prompt with Yelp's cross-domain cookie bridge: the attacker signs the victim into an attacker account on yelp.dk so the XSS runs, then sets oversized cookies so the victim's…
You Are Not Where You Think You Are, Opera Browsers Address Bar Spoofing Vulnerabilities Renwa and @RenwaX23
Seven address bar spoofs in Opera desktop and mobile: intent:// and opera-mini:// handlers that display an attacker-chosen URL over attacker content, a GX Mod that silently updates itself into a full extension and opens…