shubs

shubs

@shubs.io

Co-founder, security researcher. Building an attack surface management platform, @assetnote.io

1.8K followers155 following8 posts

shubs reposted

Sam Curry
@zlz.bsky.social

New blog post with @shubs.io: We found a vulnerability in Subaru where an attacker, with just a license plate, could retrieve the full location history, unlock, and start vehicles remotely. Full post here: samcurry.net/hacking-subaru

samcurry.netHacking Subaru: Tracking and Controlling Cars via the STARLINK Admin PanelOn November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United State...

shubs reposted

Caitlin Condon
@catc0n.bsky.social

Rapid7 analysis of Apache #Struts 2 CVE-2024-53677 here via research lead Ryan Emmons — highlights: * No, this isn't really being successfully exploited in the wild * Payloads need to be customized to the target * The 'fixed' version *does not* remediate the vuln attackerkb.com/assessments/...

attackerkb.comremmons-r7's assessment of CVE-2024-53677 | AttackerKBCVE-2024-53677 is a flawed upload logic vulnerability in Apache Struts 2. The vulnerability permits an attacker to override internal file upload variables in a…
shubs
@shubs.io

This is really great research by @ryotak.net - I appreciated that he covered some of his experiments along the way, and how he landed on a finely tuned way of finding a 12-char hash collision with a command injection payload at the end. flatt.tech/research/pos...

flatt.techCompromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command InjectionIntroduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After ac...
shubs
@shubs.io

This is amazing. I’ve been in this scenario several times where the good old days of dropping a JSP file is not possible.

ϻг_ϻε@steven.srcincite.io

I just wrote a new blog post! This is how I (ab)used a jailed file write bug in Tomcat/Spring. Enjoy! Remote Code Execution with Spring Properties :: srcincite.io/blog/2024/11...

srcincite.ioRemote Code Execution with Spring PropertiesRecently a past student came to me with a very interesting unauthenticated vulnerability in a Spring application that they were having a hard time exploiting...
shubs
@shubs.io

queued up tonight but just missed out, if anyone is selling tickets, looking for two tickets to ccc #38c3

shubs
@shubs.io

Earlier this year, Assetnote's Security Research team discovered a vulnerability in Sitecore XP (CVE-2024-46938) that can lead to pre-authentication RCE. Order of operations bugs are one of my favorite types of bugs :) Write up and exploit script here: assetnote.io/resources/re...

You are up to date.