My CVE, bug bounty, and general cybersec relevant reading list and notes

Misc Links

National Vulnerability Database: here.
- NVD CVE search: here.
- NVD data feeds listing: here.
CVE details CVSS distribution listing: here.
Mitre CVE search: here.
Pentesterland list of bug bounty writeups: here.
JFrog security research blogroll: here.
vuldb listing: here.

Title	Notes	CVE	Key Takeaways	Tags
GitLab GraphQL API User Enumeration		CVE-2021-4191	Don't expose services to the internet unless you absolutely have to. Ensure all possible endpoints are subject to authentication if required	gitlab, hosting practices, enumeration
Arbitrary command injection in `pipenv`		CVE-2022-21668	Comments weren't ignored, because they were improperly parsing requirements files; if the thing you are parsing has a spec, parse it according to the spec. If it doesn't, make the people who own the thing you're parsing write one:)	pipenv, python
The Impact of CVE-2022-0185 Linux Kernel Vulnerability on Popular Kubernetes Engines and CVE-2022-0185 - Winning a $31337 Bounty after Pwning Ubuntu and Escaping Google's KCTF Containers	here	CVE-2022-0185	Once again, `--privileged` and SECCOMP would help save the day. Don't disable them, people! Stay up to date on kernel updates.	containers, escape
Can containers escape?	here	CVE-2022-0492	Securing containers with apparmor, selinux, or seccomp is a good idea. Also, up-to-date Linux releases are a good idea.	cgroups, containers, linux
Escaping privileged containers for fun			`mount` + `gcc` + `/proc/sys/kernel/core_pattern` + a privileged container --> arbitrary commands on container host	docker, escape, privileges

Google's syzkaller looks interesting:

syzkaller is an unsupervised coverage-guided kernel fuzzer

cgroups, controlled by cgroupfs, provide means to limit/account/isolate the resource usage of a set of processes.
- further divided into subsystems, each responsible for a specific resource (e.g memory cgroup, device cgroup, etc)
  - any further nested are new cgroups under that subsystem
cat /proc/self/cgroup shows cgroup membership
Arbitrary binaries (run with highest possible, root, permissions) can be ran by the termination of a proc in a cgroup if there has been a binary assigned to the subsystem's release_agent, and the child process has notify_on_release enabled.
- This is OK, if the system was checking that the child proc had the CAP_SYS_ADMIN perms to run it first. It was not.
- Writing to notify_on_release still requires root within the container.
cgroups are RO mounts inside containers (mount | grep "cgroup (ro")
Utility helper/checker function: Palo Alto Networks - can container escape