What's new at Detectify

Alfred Berg

Security Researcher

New tests released based on submissions by our Detectify Crowdsource hackers:

• CVE-2023-6020: Ray Local File Inclusion
• CVE-2023-6018: Mlflow Arbitrary File Write via model-versions API
• CVE-2023-50290: Apache Solr Environment Variables Disclosure
• CVE-2023-49070: Apache OFBiz Arbitrary Code Execution
• CVE-2023-46805: Ivanti Connect Secure and Policy Secure Authentication Bypass
• CVE-2023-44353: Adobe ColdFusion WDDX Deserialization Gadgets
• CVE-2023-44352: Adobe Coldfusion Reflected XSS
• CVE-2023-26347: Adobe ColdFusion Improper Access Control
• CVE-2023-22232: Adobe Connect LFD
• CVE-2022-48197: YUI2 XSS
• CVE-2020-27838: KeyCloak Information Exposure
• Hasura Database Dump
• Kubelets API / Running Pods RCE
• Mlflow: Unauthenticated Access
• OAuth Client ID and Client Secret Disclosure
• Ray Dashboard Exposure
• Tautulli Unauthenticated Panel Access
• Vite Configuration Disclosure

New tests released by Detectify staff:

• Configuration File Disclosure
• Directory Listing File Disclosure
• GitWeb Exposure
• GitWeb Exposure Unexecuted
• Indicator of Compromise: "Hacked by"
• Mailmodo API Key Disclosure
• PHP "PHP-Quick-Profiler" Exposure
• Phalcon Environment Variables Exposure
• Python Starlette Debug Mode Enabled
• Spring Boot Actuator / HTTP Exchanges
• Spring Boot Actuator / Integration Graph
• Spring Boot Actuator / Quartz
• Symfony Profiler Exposure
• Tautulli Installer Exposure
• Tomcat SnoopServlet Exposure

Improved tests to reduce false positives:

• CVE-2023-49103: OwnCloud Phpinfo Configuration
• Jolokia Endpoint Exposure
• Redis Configuration Exposure
• SVN Source Code Disclosure

Improved tests to reduce false negatives:

• CVE-2023-38205: Adobe ColdFusion Improper Access Control
• Adobe AEM Query Builder Exposure
• Adobe AEM Query Builder Exposure
• Adobe AEM Query Debugger Exposure
• Atlassian Jira Dashboard Exposure
• Bash Profile Exposure
• Django Secret Key Disclosure
• Editor Config Exposure
• Git Attributes File Exposure
• Jaeger UI Exposure
• Jetbrains IntelliJ IDEA modules.xml File Exposure
• Visual Studio Code SFTP Configuration Disclosure
• Visual Studio Code Settings Credential Exposure
• Visual Studio Code Settings Exposure
• VisualStudio Code Container Configuration Exposure
• WordPress Arbitrary Shortcode Execution
• desktop.ini Exposure

Test now running in both Application scanning and Surface Monitoring, previously only in Application scanning:

• CVE-2015-7297: SQL injection vulnerability in Joomla! 3.2 before 3.4.4
• Add_vhost.php exposure
• Apache Tomcat Status Exposure
• CGI testcgi.exe XSS
• CKfinder 3 File Browser Disclosure
• Django running in Debug-mode
• Eclipse Build Properties
• Environment Variables Disclosure
• Fantastico Filename Listing
• JetBrains DB DataSources Exposure
• Jetty config exposure
• Joomla! Backup disclosure
• Joomla! Joomanager Path Traversal
• Mercurial Dirstate File Disclosure
• Ntopng Reflected XSS
• PostgreSQL History Exposure
• PostgreSQL History Exposure
• SharePoint Files Disclosure
• SharePoint Layouts Disclosure
• SharePoint Layouts Disclosure
• SharePoint Lists API Disclosure
• SharePoint Master Page Disclosure
• SharePoint Site Collection Disclosure
• SharePoint Site Pages Disclosure
• Unauthenticated phpMyAdmin

Improved finding information:

• ActiveAdmin Admin Dashboard Exposure