Rapid7 Blog

I initially glossed over this believing it may be something trivial, but it really is a deeper XSS concern.

It feels weird me to dismiss as wontfix a security issue that gives the archived page far greater access to browser data than it has loaded at its original URL.

> Last updated at Tue, 16 Jan 2024 16:26:37 GMT

> tldr: For now, don't open .webarchive files, and check the Metasploit module, Apple Safari .webarchive File Format UXSS

> Safari's webarchive format saves all the resources in a web page - images, scripts, stylesheets - into a single file. A flaw exists in the security model behind webarchives that allows us to execute script in the context of any domain (a Universal Cross-site Scripting bug). In order to exploit this vulnerability, an attacker must somehow deliver the webarchive file to the victim and have the victim manually open it ^1 (e.g. through email or a forced download), after ignoring a potential "this content was downloaded from a webpage" warning message ^2.

Just look at the number of (relatively trivial) attack vectors identified by the author in this post:

> Attack Vector #1: Steal the user's cookies.

> Attack Vector #2: Steal CSRF tokens.

> Attack Vector #3: Steal local files.

> Attack Vector #4: Steal saved form passwords.

> Attack Vector #5: Store poisoned javascript in the user's cache.

https://www.rapid7.com/blog/post/2013/04/25/abusing-safaris-webarchive-file-format/

Rapid7 - https://rapid7.com - Full-Time - ONSITE - Torronto, Dublin

Dublin Positions: Lead UX Designer, Senior Software Engineer - Architecture, Senior Software Engineer, Platform Delivery (devops)

Toronto Positions: Platform Delivery (devops)

https://www.rapid7.com/company/jobs.jsp

The Dublin Positions are all focused on Logentries, which is a real-time log management and analytics service targeting mostly the DevOps and IT market expanding onto Security. If you are interested in scaling systems, search on unstructured data, handling log data at scale or are interested in migrating angular based applications to react send an email to udangel@rapid7.com

The Toronto Position Platform Delivery is a devops role, focused on helping the local teams to apply the best practices around deployments, release engineering and cloud infrastructure. Besides working on moving applications into AWS you will be also working on classical Release Engineering focused on on-prem software and their test and release process. The cloud stack consists mainly of Ruby, Chef, AWS, Cloudformation/convection, node etc. If you are interested in bringing best practices and patterns into our Toronto office reach out directly to me via udangel@rapid7.com

Rapid7's article on the topic[1] mostly focuses on the need for providing enough information to IT admins so they can understand the severity of the problem. There are other unsaid reasons for this (credit/payment I'd imagine is part of it), but on face value doesn't this make sense? When Metabase[2] says "Upgrade your instance NOW" and they have a vuln that "allows unprivileged access to any Metabase instance" I upgraded immediately. When JetBrains[3] says "4 security problems have been fixed. We highly recommend installing this update as it includes a fix for a critical security vulnerability" then many people are not going to upgrade as quickly. Jetbrains eventually gave more information[4] but would they have done this if Rapid7 wasn't threatening to disclose it themselves?

^1: https://www.rapid7.com/blog/post/2022/06/06/the-hidden-harm-of-silent-patches/

^2: https://discourse.metabase.com/t/upgrade-your-metabase-instance-now/26062

^3: https://www.jetbrains.com/help/teamcity/teamcity-2023-11-4-release-notes.html#Security

^4: https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/

Rapid7 | Senior Software Engineer | REMOTE or Arlington, VA | Full time

The Rapid7 Labs team uses our experience, expertise, and passion for cyber security to establish a leading understanding of worldwide emerging attacker methodologies.

In this senior role, you will cover multiple disciplines. This includes Data Engineering to enable and enhance our petabyte-scale internet scaling platform (Project Sonar) and our global honeypot network (Project Heisenberg) which drive research, enhance products, and empower the community. This role requires being a seasoned Software Engineer too as we build out proof of concept projects that may later become Rapid7 products. As a strong software engineer, you have experience in writing maintainable code that is properly instrumented and tested. You should love being always on the lookout for better solutions and keeping technical debt at bay.

Tech stack: Python, Django REST Framework, AWS, Glue, Athena, Kafka, KSQLDB, PostgreSQL, Apache Airflow, Kubernetes

About the team: Remote, agile/sprint, test-driven development, write clean code

Learn more about our Research team here:
https://www.rapid7.com/research/

Apply via LinkedIn here: https://r-7.co/3lICm9E

> but thanks to the vulnerable PQescapeString(), the following user_input would fuck it up

Nope. To quote: https://www.rapid7.com/blog/post/2025/02/13/cve-2025-1094-postgresql-psql-sql-injection-fixed/

> Because of how PostgreSQL string escaping routines handle invalid UTF-8 characters, in combination with how invalid byte sequences within the invalid UTF-8 characters are processed by psql

If you just pass it to postgres over a normal query, postgres will reject an invalid byte sequence in the query with an error, refuse to even parse the query, and thus you won't get a SQL injection. It's just that psql didn't hard-error on invalid utf-8, even though postgres did.

That's why the escape function was suitable for postgres, both the escape function and postgres's query parser assume invalid byte sequences are, you know, invalid.

> For parametrized queries, params don't go through serialization because they don't need to hit the parser, there's no "escaping" whatsoever.

You're right of course, I used imprecise language that everyone understands, and you're choosing to read critically in order to be combative.

You don't have to be so combative.

Rapid7 | Remote | Senior Devops Engineer

Rapid7 is probably most well known for Metasploit but also develops various SaaS security software. All of our SaaS systems are hosted within AWS and we are adding to our teams and focused on improving the architecture of our software to be more effective and resilient. This is a team which focuses on complex problems across many technologies to make them more efficient, secure and reliable.

You will be working across different product teams and collaborating both with engineering teams, finance and leadership to introduce changes and provide visibility.

You should have a great understanding of AWS, excellent troubleshooting skills and a thirst for knowledge.

- Senior Devops Engineer - https://www.rapid7.com/careers/jobs/detail/?jid=R3101

- Site Reliability Engineer - https://www.rapid7.com/careers/jobs/detail/?jid=R3404

- Lead DevOps Engineer https://www.rapid7.com/careers/jobs/detail/?jid=R3832