SANS Stormcast Monday, September 21st, 2026: HTTP Query; Docker Escape; Brevo ClickFix Attack; LastPass Fake GitHub Repo

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10102.mp3

previous

HTTP Query; Docker Escape; Brevo ClickFix Attack; LastPass Fake GitHub Repo

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Monday, September 21st, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from Las
 Vegas, Nevada. And this episode is brought to you by
 the SANS.edu Graduate Certificate Program in
 Industrial Control System Security. In last Friday's
 diary, Xavier took a look at a quite new HTTP method and
 that's the query method. This method was introduced to solve
 a problem with REST APIs. In REST APIs, requests that do
 not make any changes but just request data are supposed to
 be GET requests. They're often referred to as SAVE requests
 because well they don't make any changes. However, GET
 queries, well they must not contain a body limiting about
 the data that you can submit with the request. Like if you
 have a more complex query string, it may not fit. There
 is no actually official upper limit to how long a URL can be
 but many browsers cab it at like four to eight kilobytes,
 which sounds big but again if you want to do something more
 complex may not be sufficient. So, what he came up with was
 the query method. It's essentially a GET method but
 allowing for a body and what Xavier is going over here is
 well how is it supported by different browsers, different
 clients and also middleware which of course these middle
 boxes are often being used for security tasks. So, Xavier for
 example enumerates which ones just outright block them or
 just allow them unchecked. The other issue here is that is
 the reason also that well now the body actually matters and
 for example well query can be cached. That's explicitly
 allowed in the standard but many proxies when they're
 caching they only consider the URL and the headers. So, they
 may not consider the body which of course could lead to
 cache poisoning. Well, Xavier has a nice little table there
 summarizing all the results so if you are working with rest
 apis and consider implementing some apis that take advantage
 of the query method definitely take a look. I'm not often
 talking about container escapes but a new docker
 escape exploit in docker on the mac is interesting for how
 easy it is to exploit. To start out with the attacker
 opens a file with the same name of a file that actually
 exists on the host and the attacker keeps the file open
 that's important here. Now the file is also located inside a
 directory that the attacker created as well on the host.
 So, really the only thing the attacker needs to do is create
 those two files the directory and the file and then the
 attacker deletes the file but because the file is still held
 open the node id will continue to persist. Next the attacker
 deletes the folder that contained the file and replace
 it with a symlink. The host will now follow the symlink to
 the host which provides access to any file on the host and
 yeah it's always easy of course to find some file like
 a .cshrc file or so that can be used that is known to
 exist. So, that makes this really sort of a very quick
 and easy container escape only takes three lines of bash in
 the proof of concept. Thanks for accomplish. AI to actually
 hold back a little bit on releasing all these details
 because fix for this particular vulnerability has
 been released end of August and early September.
 And then we got sort of an interesting mix of the almost
 10 year old mage card attack and click fix. Attackers
 compromised bravo a company selling messaging solutions in
 order to use their messaging solutions to use their
 software to
 use their software. So, the attacker was able to use the
 software to use the software to use the software. Now, the
 attacker gained access to bravo's cloudflare API key and
 this API key was not restricted. So, the attacker
 could then set up a worker injecting javascript into web
 pages associated with a bravo customers. And the end result
 was that affected pages displayed a click fix style
 capture that tricked victims to execute code that installed
 malware on their system. Now, sadly, the bravo advisor is
 really short in details about this particular malware.
 They're really more concerned telling us that their customer
 information apparently was not compromised. just their
 customers systems were compromised. Beeping computer
 flagged a file uploaded to VirusTotal as associated with
 the attack. So far, this file has only gotten one hit among
 the 50 plus scanners hosted by VirusTotal. Freevo is now
 looking into solutions to better manage its API keys.
 Always good to at least improve after being hit by an
 attack.
 And password manager LastPass reports in its blog that it
 was one of 40 companies that an attacker attempted to
 impersonate on GitHub. So, nothing here wrong with
 LastPass. Just someone impersonated LastPass, set up
 fake GitHub repositories that then basically offered the
 password manager or password. something that looked like it
 for download, which contained interestingly a kernel driver
 that was actually tested by Microsoft. So, it was trusted
 by the kernel that then led to privilege escalation and the
 malware was able to disable numerous anti-malware
 products. leveraging this kernel module. Once it settled
 in, the malware went ahead and stole credentials. Again,
 nothing here really wrong with LastPass. If anything, they
 paid attention to actually identify these malicious
 GitHub repositories. Other companies were affected as
 well as stated by LastPass. And as usual, well, not just
 with password managers. Be careful where you download
 your software from.
 Well, and this is it for today. Thanks again for
 listening, subscribing, recommending this podcast. And
 if you are here in Vegas at the SANS event, well, I'll try
 to keep some stickers around. But if you don't find them
 like on the hallways or so, then please see me in my
 classroom. I'll be teaching SEC 522, our web application
 security class here. And otherwise, talk to you again
 tomorrow. Bye.