0 Persons are tagged with #poc

#poc

tresronours@parlote.facil.services
Alexandre

Critical Apache OfBiz Zero-Day Let Attackers Bypass Authentication

A new vulnerability has been discovered in Apache OfBiz, an open-source Enterprise Resource Planning (ERP) system.

Apache OfBiz is used as a part of the software supply chain in Atlassian’s JIRA, which is predominantly used in several organizations. This vulnerability was a bypass to a previously discovered vulnerability, CVE-2023-49070.

Since the root issue of CVE-2023-49070 was left open, a bypass has been discovered as a workaround for the patch. This new vulnerability has been assigned with CVE-2023-51467, and the severity has been given as 9.8 (Critical).

Apache OfBiz Zero-Day

CVE-2023-49070 was a pre-auth RCE vulnerability due to the presence of XML-RPC, which is no longer maintained. However, the released patch was only with removing XML RPC code from the application, which was open for an authentication bypass.

Test Cases

There were two test cases for exploiting this vulnerability—the first one involved including the requirePasswordChange=Y in the URI with empty USERNAME and PASSWORD parameters.

Due to the misconfiguration of the login condition block, the application resulted in the checkLogin function returning with a “success,” leading to the authentication bypass.

[

#CVE

](https://twitter.com/hashtag/CVE?src=hash&ref_src=twsrc%5Etfw)

-2023-49070

Pre-auth RCE Apache Ofbiz 18.12.09

[

#POC

](https://twitter.com/hashtag/POC?src=hash&ref_src=twsrc%5Etfw)

:

/webtools/control/xmlrpc;/?USERNAME=&PASSWORD=s&requirePasswordChange=Y

Ref:

[

https://t.co/NSgI7IQckp

](https://t.co/NSgI7IQckp)

cc to me.

[

pic.twitter.com/SHOkhzlH09

](https://t.co/SHOkhzlH09)

— Siebene@ (@Siebene7)

[

December 5, 2023

](https://twitter.com/Siebene7/status/1731870759130427726?ref_src=twsrc%5Etfw)

The second test case was similar to the first one, with slightly changing parameters. The USERNAME and PASSWORD parameters are submitted with invalid values.

However, the checkLogin function flow did not enter into the conditional block, which resulted in the authentication being bypassed.

[

#CVE

](https://twitter.com/hashtag/CVE?src=hash&ref_src=twsrc%5Etfw)

-2023-49070 Apache Ofbiz XML-RPC

[

#RCE

](https://twitter.com/hashtag/RCE?src=hash&ref_src=twsrc%5Etfw)

Affected Versions: < 18.12.10

[

pic.twitter.com/9QfiCty04f

](https://t.co/9QfiCty04f)

— M4rtin Hsu (@0xf4n9x)

[

December 6, 2023

](https://twitter.com/_0xf4n9x_/status/1732289811665559775?ref_src=twsrc%5Etfw)

This vulnerability has a publicly available exploit, which penetration testers and security engineers can use to test if the vulnerability exists on their application.

Furthermore, a complete report about this vulnerability has been published by SonicWall, providing detailed information about the code analysis, exploitation, and other information.

Apache OfBiz has fixed this vulnerability in version 18.12.11 and newer. Users of Apache OfBiz are recommended to upgrade to the latest version of this software to prevent this vulnerability from getting exploited by threat actors.

The post Critical Apache OfBiz Zero-Day Let Attackers Bypass Authentication appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
posted by pod_feeder

One person like that
deutschewelle@squeet.me
Deutsche Welle (inoffiziell)

Roald Dahl-Neufassung: Was macht ein Sensitivity Reader? | DW | 24.02.2023

Neben den Neufassungen von Roald Dahls Kinderbüchern will der Penguin Verlag noch 2023 eine unveränderte “Classic Collection” herausbringen. Er reagiert damit auf Kritik an der Neufassung nach einem Sensitivity Reading.#SensitivityReading #RoaldDahl #CharlieunddieSchokoladenfabrik #Shakespeare #Diversität #POC
Roald Dahl-Neufassung: Was macht ein Sensitivity Reader? | DW | 24.02.2023

Roald Dahl-Neufassung: Was macht ein Sensitivity Reader? | DW | 24.02.2023

Neben den Neufassungen von Roald Dahls Kinderbüchern will der Penguin Verlag noch 2023 eine unveränderte “Classic Collection” herausbringen. Er reagiert damit auf Kritik an der Neufassung nach einem Sensitivity Reading.

One person like that
jjhobbs@diaspora.permutationsofchaos.com
Jed Hobbs

Over the night, I updated the pod to version 0.6.2 as well as migrated it to a new server. As many have noticed in the past, most of the social networking plugins were broken. I have completely removed them in the new server. If you notice anything missing and/or broken, please let me know either by emailing me under the “Got a problem?” link or PM’ing me. #POC #Podmin #Update

denissalem@diasp.eu
Denis Salem


http://universe.tuxfamily.org

Bon et donc c'est cool j'ai implémenté côté GPU une génération de diagrammes de Vonoroï en deux variantes convoluées avec une cloche générée avec la formule d'interpolation utilisée dans le bruit de Perlin amélioré. C'est d'ailleurs cette cloche qui remplacera, en plus des autres tampons le cône que j'utilisais dans le stamp noise.

Comme le procédé est très simple à expliquer je devrais sortir un article très bientôt sur le sujet :)

À bientôt!
#Perlin #BruitDePerlin #GénérationProcédurale #Procédurale #Algorithme #OpenSource #Libre #CC #CreativeCommon #Blog #UNIVERSE #denissalem #OpenGL #VR #RéalitéVirtuel #univers #3D #math #algorithmique #analyse #mathématique #mathématiques #GNU-GPL #dev #devlog #log #developpement #logiciel #geek #free #StampNoise #CoherentNoise #simulation #Art #code #coding #generativeArt #generativeDesign #generative #science #fractal #fractalArt #GPL #technologie #GPU #Graphic #Render #Rendering #Graphique #PoC #ProofOfConcept #Shader #ComputeShader

One person like that