Hello, welcome to the Tuesday, July 16th, 2019 edition of the Sands and its Storm Center's

Stormcast. My name is Johannes Ulrich, in the time recording from Swindon, England.

Today we got yet another great tool by DDIH that he released. Isodump. Isodump, will help you analyze malicious iso files.

We're looking at a couple of them over the last few months in various diaries,

so Didier finally got around to create a tool to automate a good part of these tasks.

Now, after yesterday's patched by Atlassian for a GERA vulnerability, we today have more details regarding an unrelated vulnerability in the Adelausian crowd product. This was also a remote code execution vulnerability that was based on the PDK

install development plugin. In a blog post by Corbyn Leo, there are more details regarding

the exact bug being addressed in this update and how it could possibly be exploited, including

proof of concept code to exploit the vulnerability.

I think this is a good reminder to double check if all of your Adelation products are properly

patched. There were a number of vulnerabilities over the last few months

that were patched in these products and some of the older ones are certainly already being

exploited. And in case you are riding spiders using the scrappy framework, which is a quick Python framework that allows

you to automate the scraping of websites, well, better be aware of some issues with this particular

tool that I don't think have fully been addressed by the Scrapey team yet.

In a blog post by Claudio Salazar, he's going over some of these issues that really sort of

center around kind of two basic problems. One is where Scrapey may escape from the scope

it was provided with, and the second problem is that Scapey may be tricked as a result into reading file

URLs, which of course are local on the machine that runs scraping.

File URLs are in general a problem and really have sort of odd security implications because

they also allow web browsers to read local files which has been abused in the past.

In this case the browser well is the tool running on a system spidering website so

...