Exploit

CVE-2024-29849

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

Published: May 22, 2024 / Updated: 6mo ago

This time, To prevent damage, the included post-exploitation technique in the poc just retrieves the list of internal file servers which should be enough to let people know the authentication has been bypassed, if you like to go full on APT with “post-exploitation” possibilities, simply, visit the following API Documentations I started from, the following method is executed when an authentication request is received, I’ll try to isolate differnt parts of the codes provided so you won’t get distracted but this is how the full implementation of this method looks like.

Black Kite helps TPRM professionals identify vendors affected by these vulnerabilities through its FocusTags TM, which provide detailed information about the exposed assets, such as IP addresses and subdomains. Black Kite assists TPRM professionals by identifying vendors affected by this vulnerability through its FocusTags, providing detailed information about exposed assets.

SECURITY AFFAIRS MALWARE NEWSLETTE

SECURITY AFFAIRS MALWARE NEWSLETTE

Microsoft Patch Tuesday security updates for November 2024 fix two actively exploited zero-days. . Ahold Delhaize experienced a cyber incident ...

SECURITY AFFAIRS MALWARE NEWSLETTE