Why does GitHub Security Lab do research like
@mmolgtm
’s recent work on bypassing MTE on the Pixel 8? This question was asked on Hacker News and we think it’s worth a short thread.
Do you want to learn how to fuzz an interactive application like GIMP using Persistent Fuzzing? Our wizard of fuzz
@Nosoynadiemas
just published exercize 6 of Fuzzing101!
Go on an RCE hunting journey with
@pwntester
as he demonstrates how he used CodeQL to find multiple RCE vulnerabilities in Apache Dubbo: "All roads lead to RCE"
"Exploits are really the closest thing to magic spells we have in this world" according to Halvar Flake.
@kevin_backhouse
demystifies an exploit of a double-free vulnerability in Ubuntu
Continuing our series analyzing recent CVEs, with a remote code execution on Exchange servers. Read
@pwntester
's "CVE-2020-0688 Losing the keys to your kingdom"
The first CodeQL online course is now available for free on GitHub Learning Lab! This course invites CodeQL beginners to follow in the footsteps of our security research team and find real vulns in Das-UBoot (patched since). Join other CodeQL learners:
Learn all about how to fuzz network services in this practical case study by
@nosoynadiemas
in which he fuzzes 3 of the most popular Open Source FTP servers!
Looking for a vulnerability hunting challenge? Then this Java CTF challenge is for you! You will hone your bug finding skills to find a pre-auth RCE and also learn all about CodeQL's taint tracking features.
Bugfix and chill!
@pwntester
reported 2 Server-Side Template Injections in Netflix open source libraries, enabling attackers to inject arbitrary Java EL expressions, leading to a pre-auth Remote Code Execution (RCE) vuln: First one in Netflix Conductor
Hey fuzzers! Do you want to learn how to use an WMV file to trigger a bug in VLC Media Player? Exercize 7 of
@Nosoynadiemas
's Fuzzing 101 is up and waiting for you!
In this post
@mmolgtm
goes through the details of CVE-2022-1134, a type confusion in Chrome, and shows how to gain remote code execution in the Chrome renderer using this bug.
Curious how the recently patched Chrome 0days (CVE-2021-30632, CVE-2021-30633) affected you?
@mmolgtm
explores the fascinating intricacies of exploiting optimized property access based type confusions in Chrome's v8 JIT
The Qihoo 360 Alpha Lab presented a great example of how
#CodeQL
driven variant analysis can be used to hunt for 0day in Chrome and amplify your security research results at Blackhat 2021:
If you don't learn from past CVEs you are doomed to repeat the same mistakes.
@pwntester
starts a new series of articles deconstructing CVEs. Let's start with a RFD in the Spring framework.
Want to learn software security and have fun doing it? 🎉 🔒 Check out Secure Code Game - a FREE, hands-on training simulating what you do on a daily basis. Start playing now at 🎮 Read more at
How do static analysis tools detect vulnerabilities in software? Learn more about the fundamentals of static analysis and security research, and challenge yourself with exercises in the first part of CodeQL Zero to Hero series by
@BlazingWindSec
In this post "Corrupting memory without memory corruption"
@mmolgtm
is showing how a powerful kernel bug, CVE-2022-20186, can be used to root a Pixel 6 from a malicious app
In this blog post
@mmolgtm
shows how to bypass various modern mitigation implemented in the Android kernel and exploit CVE-2022-22057 to gain root from a malicious Android app
Unravel some hidden vulnerabilities in mTLS systems with
@artsploit
. As presented at
@BlackHatEvents
and
@defcon
this year, the research is now available in our blog.
🚀 CodeQL zero to hero part 3: Security research with CodeQL! Learn how to audit applications for vulnerabilities with CodeQL, tricks we can use for security research workflow, and how to find bugs in thousands of GitHub repos at once using MRVA.
We paid a $4,000 bounty to
@JLLeitschuh
, for his amazing bug slayer submission. He didn't only reported 1,597 bugs, but also sent the PRs to fix them. That's what we call open source security at scale!
🧐 Dive into the world of exploit development on Linux with: "Cueing up a Calculator: An Introduction to Exploit Development on Linux" by
@kevin_backhouse
Check it out now 👉
Curious how
@mmolgtm
managed to actually exploit that Chrome WebAudio Use After Free he found back in March? 🎃 Mo shares his tricks and treats us with his latest post on Chrome UAF exploitation 👻
Awesome CodeQL query from
@ggolawski
that detects many variants of LDAP Injections in Java: Plain Java JNDI, UnboundID, Spring LDAP and Apache LDAP API. We are pleased to award him our maximum bounty reward $3000
Join
@oxfordmaths
and
@nicowaisman
for LiveQL, an unscripted live auditing session, as they cover some methods of finding non-intuitive string manipulation vulnerabilities in C code on tomorrow's Security Live Stream!
Being transparent about potential security vulnerabilities helps increase trust in your project. We believe it's much better to request a CVE and publish a security advisory than to stay silent and hope for the best, even for low severity vulnerabilities.
Get root privileges on an Android phone! Learn how
@mmolgtm
discovered CVE-2022-46395 in the Arm Mali kernel driver via root cause analysis of a Project Zero bug and then used it to get root privileges!
Follow
@pwntester
on another CodeQL adventure as he builds and iterates on top of prior community findings to find and fix additional vulnerabilities in NSA's Emissary software: "Don't shoot the emissary"
We’re launching a series of office hours for open source maintainers! Do you need advice to secure your project’s code? Grab some time to chat with our team. Spots are limited and run until end of April
You have two weeks left to join our Capture the Flag contest and win a Nintendo Switch, or cool GitHub swag! Write a CodeQL query to find a specific class of DOM-based XSS vulnerabilities.
Learn how
@mmolgtm
dug his way out of the Chrome sandbox using a credit card as a shovel! "The fugitive in Java: Escaping to Java to escape the Chrome sandbox"
ICYMI
@mmolgtm
explains how to exploit CVE-2020-6449, a use-after-free (UAF) in the WebAudio module of Chrome, and achieve a sandboxed RCE. Read also how he used
#CodeQL
to accelerate his code audit
If you’re out of popcorn you’re in luck because
@mmolgtm
popped some fresh Android kernels for you to enjoy! "One day short of a full chain: Part 1 - Android Kernel arbitrary code execution"
Learn to find and fix security issues while having fun with Secure Code Game, now with new challenges focusing on JavaScript, Python, Go, and GitHub Actions! 🎮🔐
It’s amazing what you can find for free in the garbage sometimes! Read
@mmolgtm
’s research into how Chrome’s garbage collector can be used to trigger UAF
Learn more about how developers and administrators can secure their assets through the use of SELinux in this introduction to SELinux by Kevin Stubbings!
"Our goal is for every CVE in OSS that gets found that could be generalized, we create a CodeQL query that will cover that. Instead of manually fixing bugs one at a time, we can eradicate whole categories of vulnerabilities across software"
@natfriedman
In this post
@mmolgtm
shows how to get Remote Code Execution (RCE) in Chrome, by exploiting the type confusion vulnerability CVE-2023-4069 in the Maglev compiler.
Having a hard time remembering where you put those Apache bugs? Join
@Nosoynadiemas
as he builds custom ASAN interceptors for memory bugs in Part 2 of "Fuzzing sockets: Apache HTTP"
Take a deep dive into command injection vulns with
@mdisec
's talk at the GitHub Security meetup. Tune in Wednesday July 15, 2020, at 5pm CET (Central Europe) - 8am PDT (Pacific Time)
In his latest post,
@mmolgtm
sheds light on a patching problem in Pixel 6 (GHSL-2023-005) that can leave your device vulnerable to a variant of CVE-2022-38181, enabling malicious apps to gain root access. Read 👉
If you write a nice CodeQL query and propose it to the open source community, you can get not one, but TWO bounty rewards from the Security Lab. We're making changes to the Bug Slayer bug bounty program:
Join us for the very first episode of LiveQL! An interactive CodeQL-driven security research session featuring
@nicowaisman
and
@oxfordmaths
on Tuesday July 7th, 11am PDT.
Your challenge, should you choose to accept it, is to elevate your privileges from read-only to full write access on a designated game repository and claim your victory!
Ready?
Congrats to our CTF winners! 1st place goes to
@paraschetal
, with an impressive query, with tests and exploits! 2nd place goes to
@Kachakil
who took the time to give very detailed explanations. Well done guys! Hope you had fun! Solutions are coming soon
ICYMI: We're running a CTF until December 31st. Write a CodeQL query to find a specific class of DOM-based XSS vulns. The 2 best submissions will win Nintendo Switches, and 10 additional entries will receive coupons that can be used for GitHub Swag.