PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2019-11510] Breaching the Trusted Perimeter | Automating Exploitation

bishopfox.com | vulnerability | CVE-2019-11510 | #automation | #exploit | #ssl-vpn | #pulse-secure | #cve-2019-11510
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox's Jon Williams developed a Bash exploit for Pulse Secure SSL VPN's pre-auth arbitrary file read (CVE-2019-11510), automating config dumps and credential/session extraction.
CVE
CVE-2019-11510
Published
Collected

Related coverage

vulnerability · volexity.com
Vulnerable Private Networks: Corporate VPNs Exploited in the Wild
The details of multiple, critical Pulse Secure SSL VPN vulnerabilities are well known; they were disclosed in detail by two security researchers as part of a talk at Black Hat […]
vulnerability · bishopfox.com
SonicWall-CVE-2024-53704: Exploit Details
Bishop Fox explains its CVE-2024-53704 exploit: unauthenticated attackers can hijack active SSL VPN sessions on unpatched SonicWall firewalls and open tunnels without the victim's password. Patch now.
vulnerability · bishopfox.com
SonicWall CVE-2024-53704: SSL VPN Session Hijacking
Exploit details for CVE-2024-53704: Bishop Fox walks through the reverse engineering behind the SSL VPN session-hijacking flaw in unpatched SonicWall devices and urges January 2025 patches.
vulnerability · bishopfox.com
CVE-2024-21762 Vulnerability Scanner for FortiGate Firewalls
Bishop Fox built a scanner that safely detects FortiGate appliances affected by CVE-2024-21762, an out-of-bounds write in FortiOS SSL VPN, via chunked-encoding validation changes in the patch.
vulnerability · bishopfox.com
Building an Exploit for FortiGate Vulnerability CVE-2023-27997
Bishop Fox walks through building a proof-of-concept exploit for CVE-2023-27997, a pre-auth heap buffer overflow in Fortinet's SSL VPN, covering the flawed length check and jemalloc heap grooming.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
Back