Notes from a working penetration tester: the vulnerability classes behind real CVEs, how we actually test for them, and what you can check in your own application today.
CVE-2024-23897 let attackers read files off a Jenkins server, and nobody had written a download endpoint — a convenience feature expanded a filename it was given. Why arbitrary file read is triaged as medium and behaves like a critical, and the five places your application lets a client decide which file to open.
Read the postDiscounts, approvals and one-time credits can break their own rules without a malformed request. Three examples show the expected flow, the failure, and illustrative code for enforcing each rule.
Read the postCVE-2023-34362 was a SQL injection flaw in MOVEit Transfer, and it became one of the largest data theft campaigns on record. Your ORM has probably settled this for ninety per cent of your queries — here are the five places the other ten per cent live, starting with the sortable table on your dashboard.
Read the postCVE-2024-27198 handed unauthenticated attackers administrative control of TeamCity. Nothing was cracked and no password was guessed — two components simply disagreed about which URL had been requested. The five shapes that disagreement takes in a modern stack, starting with the proxy sitting in front of your application right now.
Read the postA CVSS 10.0 flaw in Confluence Data Center let an unauthenticated attacker create an administrator account. The CVE is three years old and patched — but the bug class underneath it is the single most common serious finding we report. Here is the root cause, the five shapes it takes in modern SaaS applications, and the exact method we use to find it.
Read the postCVE-2021-26855 — ProxyLogon — let anyone make Exchange issue requests on their behalf. Your application almost certainly has a feature that fetches a URL, and it is standing inside your network. The five shapes SSRF takes, the cloud metadata endpoint that makes it critical, and how we prove it out-of-band.
Read the postCVE-2023-4966 leaked valid session tokens, so attackers never authenticated and multi-factor never came into it. Organisations patched, reported themselves fixed, and were breached anyway. The five session failures we find in ordinary applications — starting with the logout button that doesn't.
Read the postMore posts on the way — multi-tenant isolation and practical testing methods. Want one on a specific vulnerability class? Tell us what to write about.
We test manually, for a fixed price, and the retest is included. Get a quote in minutes.