Het Mehta
@hetmehtaa • 42,117 subscribers
Security Engineer | Content Creator | I talk about Cybersecurity, Tech, Privacy, AI & Startups | Building @100xSecurity
Videos
Every 3rd website you visit runs Nginx. 18,959,833 of them can be hijacked right now. A bug from 2008 just got a working exploit. CVE-2026-42945 (CVSS 9.2) No login. No access. Just one HTTP request. → Heap overflow → Worker process → RCE Patch ASAP to Nginx 1.31.0 or 1.30.1 PoC is already out:
Het Mehta152,448 görüntüleme • 2 ay önce
two XSS vulnerabilities. individually, each was practically useless. together, they stole your session, hijacked your OAuth token, and silently turned on your webcam. here's the chain. Zoom's web client allowed XSS in two places, and both were in self-XSS situations where you could only inject into your own context. programs usually ignore these as "No Impact." but Zoom uses OAuth for authentication. the OAuth authorization code gets passed via URL after login. if you can intercept that redirect, you get the code, you get the token, you get the account. the trick: "OAuth dirty dancing." when a victim clicks a link, the XSS on domain A sends a message to domain B using postMessage. domain B uses the XSS there to initiate an OAuth flow. the authorization code in the redirect gets sent back to the attacker. the attacker now has a valid auth code. they exchange it. full session. Bonus: Zoom's web client requests browser permissions (camera, microphone) once and remembers them. after account takeover, the attacker can silently activate those permissions in a tab the victim can't see. also: they found that the WAF could be tricked into flagging the victim as malicious by sending crafted requests that made the WAF think the victim's browser was the attacker. the victim gets blocked. denial of service via WAF frame-up. two "useless" XSS bugs. one $15,000 bounty. three attack chains. Blog:
Het Mehta15,047 görüntüleme • 19 gün önce
Daha fazla içerik yok.