Vulnerability research
Diving Into JumpServer: Attacker’s Gateway to Internal Networks (2/2)
In this second part, we delve into JumpServer's code execution vulnerabilities we discovered, and understand their root causes. Learn the importance of threat modeling and adherence to best practices can safeguard your own applications.
Read article >
Diving Into JumpServer: Attacker’s Gateway to Internal Networks (1/2)
Bastion host offers a centralized point of access and control to an internal network, but what happens when this gateway itself is compromised? In this blog series, we will dive into vulnerabilities we found in JumpServer.
Read article >
Beware the Cookie Monster: Cyberhaven Extension Vulnerability Allowed Cookie Theft
We discovered a vulnerability in Cyberhaven's browser extension that allowed attackers to steal arbitrary cookies from their victims.
Read article >
The Tainted Voyage: Uncovering Voyager's Vulnerabilities
SonarQube Cloud detected an arbitrary file upload in Voyager, tracked as CVE-2024-55417. When combined with other vulnerabilities our research team found, attackers can execute arbitrary code on the server if an authenticated user clicks on a link.
Read article >
Vulnerability Research Highlights 2024
Our Vulnerability Research team looks back at a great year and summarizes the highlights of 2024.
Read article >
Never Underestimate CSRF: Why Origin Reflection is a Bad Idea
CORS misconfigurations are often overlooked, but they can have severe consequences. We demonstrate how reflecting the origin header leads to code execution in Whistle.
Read article >