PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Roundcube XSS chained with cookie tossing for full inbox access

aikido.dev | blog | #ai-security | #attack-chains | #web-security | #xss | #roundcube | #vulnerability-disclosure | #ai-pentesting | #session-hijacking | #csp-bypass | #webmail | #cookie-tossing
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Aikido's AI pentesting agents found a stored XSS in Roundcube's display-attachment endpoint, chained with cookie tossing to hijack webmail sessions and accounts tied to that email. Fixed in 1.6.14.
Published
Collected

Related coverage

blog · vercel.com
The three types of AI bot traffic and how to handle them
Bots account for over 20% of all web traffic. A quarter of that is AI crawlers alone. But not all bots are bad. Some are key to how your site gets discovered. Learn how AI bots shape visibility and what happens if you block them.
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
research · vercel.com
Security boundaries in agentic architectures
A framework for drawing security boundaries in agentic architectures. Most agents run with zero isolation between the agent and the code it generates. Learn where to draw the boundaries, from secret injection to full application sandboxing.
blog · aikido.dev
AI agent security in Kubernetes: Why prompt injection isn't the right term
This post is based on Mackenzie's conversation with Abdel Sghiouar on The Secure Disclosure podcast. Listen to the full episode or watch below.
blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
blog · aikido.dev
Adding Aikido AI pentesting to your existing security stack
How to add Aikido's AI pentesting on top of the SAST, SCA and cloud tools you already run, from your first pentest through whitebox testing, continuous testing and remediation.
Back