PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The minefield between syntaxes: exploiting syntax confusions in the wild

yeswehack.com | blog | #bug-bounty | #arbitrary-file-read | #research | #ssrf | #parsing | #syntax-confusion
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Hunter Alex Brumen (Brumens) on syntax confusion and ambiguous parsing exploits, including turning a limited SSRF and blind file read into complete arbitrary file access, plus mitigation advice.
Published
Collected

Related coverage

blog · yeswehack.com
World Poker Tour and the Curry-Shah collab, in-flight exploits, does maths maketh the hunter? – ethical hacker news roundup
The year's final roundup: Sam Curry and Shubs Shah's World Poker Tour back-office flaw, in-flight Wi-Fi exploits, Eaton Zveare's 1,000-dealership hack and Brumen's acclaimed syntax-confusion research.
blog · yeswehack.com
Beyond ‘../../’ - a practical guide to path traversal and arbitrary file read attacks
Practical guide to path traversal and arbitrary file read attacks: path resolution quirks, encoding bypasses, exploitation in modern APIs, SSRF-chained traversal and high-value target files.
blog · bishopfox.com
Zilliz / Attu | 2.6.5
Bishop Fox disclosed two flaws in Zilliz Attu 2.6.5, the Milvus management UI. An unauthenticated SSRF combined with a regex validation bypass chains into Kubernetes namespace takeover, exposing entire clusters to attackers.
blog · blog.trailofbits.com
Escaping well-configured VSCode extensions (for profit)
Part two of the series: bypassing a Webview's localResourceRoots via URL parsing differences in VSCode's Electron browser to read arbitrary files; fixed as CVE-2022-41042 with a $7,500 bounty.
blog · bishopfox.com
An Exploration of JSON Interoperability Vulnerabilities
A survey of 49 JSON parsers shows how quirks — duplicate keys, number handling, alternate specs — create discrepancies across microservices that become business-logic vulnerabilities.
blog · blog.trailofbits.com
Two New Tools that Tame the Treachery of Files
Under DARPA SafeDocs, Trail of Bits released PolyFile and PolyTracker: ground-truth labeling of file format semantics and LLVM-based instrumentation for universal taint tracking of parsers.
Back