The security research team at ERNW publishes technical write-ups of vulnerabilities in Bluetooth, Android, Xen, Rails, and other software.
HN links it for vulnerability disclosures, including the Airoha Bluetooth headphone bugs, whose researcher posted the blog and white paper in comments, and RedStar OS watermarking.
The impact varies with the platform and parser being used, and with the extensions installed. I don't know the specifics of ExpatParser (the one used by Django), but in general, the "careless" parsing of unsanitized user-supplied XML might lead to:
- DoS
- Disclosing of sensitive files (in general, the XML has to "validate". In PHP, it's always possible to read any file accessible by the process parsing the XML).
- Making arbitrary network connections (with this an attacker can portscan a network, attack vulnerable services that would be protected by firewall, and/or use the vulnerable server as a restricted kind of proxy).
- Probing LDAP directories.
- Remote code execution.
See, for instance:
http://media.blackhat.com/bh-us-12/Briefings/Polyakov/BH_US_12_Polyakov_SSRF_Business_Slides.pdf
http://defcon.org.ua/data/2/2_Vorontsov_XXE.pdf
http://www.insinuator.net/2013/01/rails-yaml/
Edit:
As a clarification, I'm not implying that any of the above (apart from the DoS issue) is applicable to Django. I'm just saying what can possibly happen (and often happens for PHP apps).
FWIW, this kind of problem is minor in comparison to the potential exploits that have and will continue to crop up in shared computing environments.
https://www.cs.cornell.edu/courses/cs6460/2011sp/papers/cloudsec-ccs09.pdf
https://www.informationweek.com/security/risk-management/new-virtualization-vulnerability-allows-escape-to-hypervisor-attacks/d/d-id/1104823?
http://www.insinuator.net/2013/05/analysis-of-hypervisor-breakouts/
http://slashdot.org/story/12/03/02/0059202/linode-exploit-caused-theft-of-thousands-of-bitcoins
http://thoughtsoncloud.com/index.php/2013/07/how-your-data-leaks-from-a-virtual-machine/
I was trying to find any cases of a public cloud provider's customer data being leaked or easily visible on the internal customer network, but didn't come up with anything. Somebody's got to do a study on the major cloud providers and see if the good old methods to subvert network routes still works, or if you can easily mitm vm neighbors. (My guess is you can...)
> Which priviliges is that? Can it access user data? Snoop on input/output?
This is somewhat addressed in a comment/reply by jorge:
https://insinuator.net/2020/02/critical-bluetooth-vulnerability-in-android-cve-2020-0022/#comment-103506
> Hi, the Bluetooth daemon is a process on the Android system that runs in the background (daemon) that is responsible for managing the Bluetooth controller and handling of various Bluetooth related protocols, such as HCI, L2CAP and GATT. As it has to process attacker-controlled input it is susceptible to attacks. In addition, it has to run with high privileges (not as ‘root’ like on Linux) to support features like:
– file transfer => read files
– share Internet connection => configure network and VPN
– Human Interaction Devices => emulate keyboard and mouse
>Clustering is built into it with security
Just to note, distributed erlang is NOT secure AT ALL. You absolutely need your own source of network isolation to keep it secure.
By default the EPMD daemon (that coordinates nodes in a cluster) listens on an open port and accepts node join requests if they contain a correct secret cookie (short authentication string). EPMD has zero protection against brute force attempts to guess a cookie. If your EPMD port is open to the internet it is trivial to gain access to your entire cluster and execute arbitrary code.
See: https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/
Exploit details were released a few days ago[1]. Some essential bits were removed, so not any script kiddie can use it, but it's only a matter of time before a full exploit available publicly.
As for how it relates to the app, I don't think it matters much. I'd imagine most people already have bluetooth enabled, so using this app or not won't change their vulnerability status.
[1] https://insinuator.net/2020/04/cve-2020-0022-an-android-8-0-9-0-bluetooth-zero-click-rce-bluefrag/
http://www.insinuator.net/2013/01/rails-yaml/
Some explanation why YAML user input is evil.
It works like this
1.9.3p327 :001 > id = YAML.load("--- !ruby/string:Arel::Nodes::SqlLiteral \"1 --\"\n") # if user input can contain arbitrary YAML
"1 --"
It looks like string, but it's not.
1.9.3p327 :002 > Keyword.where(:id => id).first
Keyword Load (0.3ms) SELECT `keywords`.* FROM `keywords` WHERE `keywords`.`id` = 1 -- LIMIT 1