Hello and welcome to the Friday, November 8, 2024 edition of the Santernet Storms, Stormcast.

My name is Johannes Ulrich and today I'm recording from Riyadh, Saudi Arabia.

So we today came across an interesting GitHub repo that advertises a Steam account checker. What this particular tool is supposed to do is

for the online gaming distribution platform Steam. It will check for a list of user names and

passwords whether or not they are correct. The only real sort of application I could think of for this kind of tool is some kind of

credential stuffing attack, but well it just says that it's meant to also check your own credentials,

not sure if you really would need a tool like this. But this is not where the story ends.

Anybody running the tool will actually be subjected to an infestiler. The Python script

does include an encrypted, an obfuscated infestaler component that will exfiltrate data to the author, likely providing them with more steam credentials to verify if their tool is working correctly.

And Cisco released a number of patches today.

One of them that sticks out affects their ultra-reliable wireless backhaul

or URWB system.

The vulnerability with a CFSS score of 10 does allow NetHacker with a crafted HP request to essentially use the web-based management interface to execute arbitrary code.

As most web applications run better as Root, Cisco decided to follow this popular design route,

and as a result, any commands executed will have full system access because, well, they are

executed with root privileges.

And talking about the web applications, there's a real great and detailed blog post by

Andrea Menin with Secura Next, who is going over various issues with validating file uploads.

Andrea, not only does an excellent job going over some of the dangers of multi-part form data

and how these structures are often difficult to parse, but also shows examples how various validators, proxies for the most part, and applications like PHP, Node.js and Python are possibly misinterpreting these various multipart form data headers and then leading to bypasses of various

filters, attempting to limit, for example, the upload of web shells. In my opinion, if there are

just two things that you do, if you do allow file uploads, then number one, don't let the user pick the file name.

...