U.S. Department of Defense discloses critical and high severity bugs

guest · Sep 4, 2020

U.S. Department of Defense discloses critical and high severity bugs
September 4, 2020
https://www.bleepingcomputer.com/ne...se-discloses-critical-and-high-severity-bugs/

The U.S. Department of Defense has disclosed today details about four security vulnerabilities on its infrastructure. Two of them have a severity high severity rating while the other two received a critical score.

The flaws were reported in August and July. They could allow attackers to hijack a subdomain, execute arbitrary code remotely, or view files on the affected machine.
Unclaimed bucket, unpatched server
All issues were reported through the Department’s vulnerability disclosure on the HackerOne bug bounty platform by distinct ethical hackers.
Click to expand...

One of the critical vulnerabilities is a subdomain takeover because of an unclaimed Amazon S3 bucket. Ethical hacker chron0x who found the issue says it could be exploited to host malicious content on a legitimate domain.
The second glitch with a critical severity rating was reported by Hzllaga on August 19. It is a remote code execution on a DoD server running Apache Solr that had been left unpatched since August 2019.
Click to expand...

In all cases, the DoD was quick to validate and fix the reported problems. According to statistics from the HackerOne platform, the Department takes about eight hours on average to triage the bugs and deals with all of them.

Since the DoD started the vulnerability disclosure program on HackerOne in November 2016, it addressed 9555 security issues. An interesting detail is that the Department dealt with more than a third of them in the past three months.
Click to expand...

guest · Nov 9, 2020

Bug hunter wins 'Researcher of the Month' award for DOD account takeover bug
November 9, 2020
https://www.zdnet.com/article/bug-h...the-month-award-for-dod-account-takeover-bug/

The US Department of Defense has fixed a severe vulnerability impacting its internal network that would have allowed threat actors to hijack DOD accounts just by modifying a few parameters in web requests sent to DOD servers.

The vulnerability was discovered by Jeff Steinburg, a security researcher at US security firm Silent Breach, and privately reported and patched via the DOD's Vulnerability Disclosure Program (VDP).
The issue received a severity rating of "Critical (9 ~ 10)" because the bug required minimal technical skills to exploit and hijack any DOD account of the attacker's choosing.

While some details about the bug have been disclosed earlier today, a full report won't be fully available; to protect the security of the DOD network.
Click to expand...

According to this summary report, the bug was categorized as an Insecure Direct Object References (IDOR) vulnerability, a bug where security checks are missing from an application, allowing hackers to modify a few parameters without any additional identity checks.
Click to expand...

Log in or Sign up

U.S. Department of Defense discloses critical and high severity bugs

guest Guest

guest Guest

Log in or Sign up

U.S. Department of Defense discloses critical and high severity bugs

guest Guest

guest Guest

Useful Searches