[HN Gopher] Chain of vulnerabilities led to RCE on Cisco Prime s...
       ___________________________________________________________________
        
       Chain of vulnerabilities led to RCE on Cisco Prime servers
        
       Author : feross
       Score  : 36 points
       Date   : 2022-01-24 13:17 UTC (10 hours ago)
        
 (HTM) web link (portswigger.net)
 (TXT) w3m dump (portswigger.net)
        
       | ianpurton wrote:
       | A couple of take aways.
       | 
       | 1. Don't put sessions in localstorage, use a cookie with the
       | Secure and HttpOnly settings. They are then inaccessible to
       | JavaScript.
       | 
       | 2. Add a Content Security Policy to your headers. Start very
       | tight i.e. default-src 'none'; style-src 'self'; img-src 'self'.
       | 
       | There's a really great PenTest checklist here
       | https://pentestbook.six2dez.com/others/web-checklist So you can
       | see it from the attackers perspective.
        
         | blincoln wrote:
         | HttpOnly doesn't make sense for most apps anymore, because so
         | much of the logic in modern web apps happens on the client side
         | in Javascript.
         | 
         | The takeaway I'd suggest instead is that when one gets a pen
         | test report back with a bunch of lower-severity issues, fix
         | them instead of deciding that anything "medium" or below gets
         | put on the backlog, because frequently a bunch of lower-
         | severity vulns can be chained together like this to yield
         | something much more dangerous.
        
           | sebazzz wrote:
           | > HttpOnly doesn't make sense for most apps anymore, because
           | so much of the logic in modern web apps happens on the client
           | side in Javascript.
           | 
           | What is wrong with cookie authentication?
        
       ___________________________________________________________________
       (page generated 2022-01-24 23:20 UTC)