NewApp Digest
search bot

XSS flaw

1-Click Exploit In Kakaotalk's Android App Allows Arbitrary Code Execution
AppWizard
June 27, 2024

1-Click Exploit In Kakaotalk’s Android App Allows Arbitrary Code Execution

The vulnerability in KakaoTalk allows attackers to leak user access tokens via the Authorization header, which can be used to take over the victim's Kakao mail account. Additionally, attackers can create new Kakao Mail accounts and access chat messages, with the ability to overwrite the user's previously registered mail address.
New Attack Technique Exploits Microsoft Management Console Files
Winsage
June 25, 2024

New Attack Technique Exploits Microsoft Management Console Files

Threat actors are exploiting a new attack technique called GrimResource, using specially crafted management saved console (MSC) files to achieve full code execution through Microsoft Management Console (MMC) while evading security defenses.
New attack uses MSC files and Windows XSS flaw to breach networks
Winsage
June 24, 2024

New attack uses MSC files and Windows XSS flaw to breach networks

The GrimResource attack exploits an old DOM-based cross-site scripting (XSS) flaw in the 'apds.dll' library, allowing the execution of arbitrary JavaScript through a crafted URL. Microsoft did not immediately fix the vulnerability, and as of March 2019, it remained unpatched. The attack involves using the XSS flaw in combination with the 'DotNetToJScript' technique to execute arbitrary .NET code. The malicious MSC file distributed by attackers references the vulnerable APDS resource in the StringTable section, triggering JS execution in the context of 'mmc.exe.'
Search