The world’s largest cosmetics and personal care company is the latest illustrious brand to enjoy the benefits of a live Bug Bounty with YesWeHack.

Websites, APIs and mobile apps belonging to L'Oréal are now significantly hardened thanks to the discovery of 71 vulnerabilities during an 18-hour event at the LeHack conference last week.

The live hacking event in Paris began at 10am on day two of LeHack (7 July) and concluded at 4am the following morning after some intensive triaging. The rewards grid went up to €5,000.

The scopes comprised a representative sample of L’Oréal’s most business-critical assets, including:

E-commerce websites for various brands and markets, built on different core technologies

Technologies highly specific to L’Oréal that process sensitive customer data

Impressed by the initial findings, L’Oréal’s security team extended the scope early in the evening to maximise the talent and unique opportunity available – a decision vindicated by the submission of some invaluable findings as the event drew to a close. Most notably, credentials were available for one added scope – an uncommon move for a live hacking event – which allowed hunters to dig deep into a new application and make some intriguing discoveries.

More than 50 YesWeHack-registered hunters kicked off the event and around 100 took part overall, with 31 making it onto the leaderboard.

 by a huge margin in his first-ever live hacking event (although he 

 until the second half of the event). He notched 142 points via nine bug reports.

In second place, ‘Borgi’ accrued 49 points from six vulnerabilities, while third on the podium was ‘cosades’, who scored 45 points from three reports.

However, the leaderboard is only one part of the story of live Bug Bounties, which are as much about (if not more so) collaboration and community.

“It was really nice to meet [fellow hunters] again and to discuss with some managers of programs I'm used to hunting on,” said ‘Aituglo’, one of the participants, in a 

Aituglo said his own pre-event automation work and the support of his peers paid dividends for L’Oréal. A custom plugin helped him “get a hit for an XSS” within five minutes of starting his hunt, then “with the help of some friends, I got a nice PoC to steal the password of the user”.

Despite the generous bounties on offer, Aituglo said that making “a lot of money” was not the overriding incentive. It’s “more to discuss and see your friends, hunt together and so on”.

“Thank you for this wonderful event. It was a pleasant surprise and an honour to top the leaderboard. This motivates me to continue learning and improving.

“It was my first in-person event in cybersecurity, and it was really exciting. The other participants were all friendly and warm. The event was well structured, with responsive support. A very positive and enriching experience.”

The event was also “an enriching experience for another hunter, @dropn0w, who 

 on X: “We learned many valuable lessons and measured our skills against the best hackers in France.”

Guillaume Kermarrec, threat and vulnerability manager at L'Oréal’s CyberDefence Center, and in charge of L'Oréal’s Bug Bounty Programs, said:

“The key benefits were meeting the security researchers, meeting the triage team, and working together to find and fix some complex vulnerabilities. We focused on our most critical websites, both global websites and from different regions, B2B and B2C, and some uncovered assets like APIs and mobile applications. Thanks to this live event we could test some new scopes with very specific configurations that couldn’t be added to our continuous program. We have found some interesting vulnerabilities at the live hacking event.”

Fabio Bührer, global application security manager at L'Oréal’s CyberDefence Center:

“The scopes have been tested in the past and now there’s a lot of good people here going through the scopes to see if there’s anything that needs to be taken care of. It’s good to meet the people who work on the program virtually and and see that they actually exist – they’re not just an avatar or AI! YesWeHack did a great job of organising this.”

From YesWeHack, a sincere and heartfelt thanks to all participants for helping to secure the digital assets of L'Oréal, the personal data of L'Oréal customers, and the global internet as a whole.

The L'Oréal event follows a recent Live Bug Bounty held for a similarly glamorous and legendary French brand: Louis Vuitton, which was more than satisfied with the outcome of 

YesWeHack’s second ‘Hack Me I'm Famous’ event

. This in turn came hot on the heels of a 

 in the scopes of Groupe Caisse des Dépôts (CDC), a French public financial institution, at InCyber Forum (FIC) Europe. The targets for LeHack 2023, meanwhile, were provided by the

 French Red Cross and retail distribution giant Les Mousquetaires Group

 and also yielded an impressive bug haul.

YesWeHack also welcomed a steady stream of ethical hackers, security researchers and other security professionals at our LeHack booth, in Cité des sciences et de l'industrie.

 CTF training platforms, we gave away countless t-shirts and other swag. Other sought-after merch was exclusively available to anyone who managed to take on our claw machine (pictured) and triumph.

Finally, many thanks to our tech ambassador, BitK, for the CTF he created exclusively for LeHack attendees (the ‘Pandemic CTF’).

L'Oréal lauds live Bug Bounty success at LeHack 2024

 has recounted how an attack on his own home network led him to uncover how an attacker could have breached 

The US telco that supplied the modems, Cox Communications, said it found no history of abuse of the relevant attack vector, patched the issue rapidly and promised a comprehensive security review, according to Curry.

“This series of vulnerabilities demonstrated a way in which a fully external attacker with no prerequisites could've executed commands and modified the settings of millions of modems, accessed any business customer's PII, and gained essentially the same permissions of an ISP support team,” wrote Curry in his latest 

Curry’s latest tour de force was the lead story in our latest 

, a monthly LinkedIn roundup of notable security research, new hunting opportunities, and hacking advice and inspiration.

The next story saw the Federation of American Scientists (FAD) urge Congress to establish 

 and create a safe harbour for research on generative AI platforms.

“While Congress encourages companies to provide bug bounties and protections for security research, this is not yet the case for AI safety research,” 

. AI companies were criticised for “implicitly threatening to ban independent researchers that demonstrate safety flaws in their systems,” and failing to “adequately test their models after they are deployed as part of an evolving product or service”.

Meanwhile, a patch was issued for a remote code execution vulnerability in PHP CGI that affects XAMPP for Windows by default, allowing unauthenticated attackers to execute arbitrary code on remote XAMPP servers through specific character sequences, reveals a 

“This vulnerability is incredibly simple, but that’s also what makes it interesting,” 

said renowned DEVCORE researcher Orange Tsai on his blog

. “Who would have thought that a patch, which has been reviewed and proven secure for the past 12 years, could be bypassed due to a minor Windows feature? I believe this feature could lead to more potential vulnerabilities.” Watchtowr Labs 

 the vulnerability and its implications further.

 secure communications suite has resurfaced, zombie-like, to 

expose an estimated 700,000 Linux-based systems

 to the risk of “full system compromise”. Downstream vendors are have been rushing out patches for the aptly dubbed 'RegreSSHion' RCE (CVE-2024-6387), which is a signal handler race condition in OpenSSH’s server (sshd). The OpenSSH team seemingly reintroduced a long-ago patched flaw (CVE-2006-5051) by mistake in a 2020 software update.

While the high severity (CVSS 8.1) issue’s impact is potentially enormous, exploitation could potentially take “approximately 10,000 attempts on average to succeed," 

, co-founder and CTO at Contrast Security, reassuringly. The issue was 

. In a recent development, it has emerged that a circulating proof-of-concept (PoC) purporting to be an exploit for CVE-2024-6387 is in reality a “trap” for security researchers, 

Nearly 30 popular apps (and potentially more as yet untested apps) and an iOS feature were vulnerable to an attack in which any installed 

 from the Apple App Store could perform a user account takeover, according to 

: “This vulnerability exploits the nuances of the OAuth protocol and iOS’s handling of Custom URL Schemes and Safari browser sessions to steal OAuth Authentication Codes from vulnerable OAuth implementations, thereby allowing an attacker to gain access to a victim’s account.” He also notes: “Unless Apple changes the behavior of ASWebAuthenticationSession, the onus is on developers to mitigate this".

A vulnerability in the Lua implementation of 

) construction and management simulation game, potentially allowed a malicious server to obtain arbitrary execution on clients, according to a researcher. Now patched, the bug is dissected in a post 

 as “one of the best exploit development write ups I've read” by one infosec redditor, which concludes with a gamified challenge to practice the techniques explored.

, Soroush Dalili, who assisted with PortSwigger’s 

, explores a scenario where the “aggregate” function in MongoDB is exposed and vulnerable to NoSQL injection attacks, increasing the impact by allowing adding or updated data, or reading data from, other collections.

A developer recently made popular open source project 'ip' read-only after “someone filed a dubious CVE about my 

” and being inundated with messages about the bug. 

 that this reflects an uptick in open source developers “receiving debatable or, in some cases, outright bogus CVE reports filed for their projects without confirmation”.

 allegedly targeted hundreds of thousands of its own customers with malware in a bid to stop them using torrenting sites, in a story first reported by a local media outlets.

 from Shubham Shah of AssetNote which will contextually insert “junk data” into your HTTP request inside the repeater tab. You can select from a preset amount of junk data you want inserted, or you can insert an arbitrary amount of junk data by selecting the "Custom" option.

, there are some Bug Bounty disclosures with unusual twists involving 

crypto exchange, as well as a new Bug Bounty Program for large language models (LLMs), and an interesting report on the growing role of 

 in capture-the-flag competitions and Bug Bounty Programs.

We’ve handcrafted some of our own hacker-focused content, as per usual, so behold: our latest bug hunter interview below (Swedish bug hunter Eldar Zeynalli, aka ‘

‘The Art of Bypassing WAFs’ from NahamCon 2024 (watch below)

, delivered by our very own in-house hunter, 

, which awards YesWeHack swag to the three best write-ups, is 

Submit your solution by 2 August to participate.

Congratulations to the winners of last month’s ‘

’ challenge: ‘Memset’, ‘Weac’ and ‘Kix29’. Kudos also to ‘lr04d’ for the first valid critical report within a mobile scope on a public program – leaving just one achievement (prize: exclusive swag pack) on our 

: discovering a valid critical bug on YesWeHack’s public program.

For Bug Bounty hunting proper, we’ve a pair of new public programs to flag, both operated by

 one of India’s leading crypto exchanges

 and offering $2,000 for critical vulnerabilities: for the

 crypto exchange platform and CoinDCX’s orchestration layer of Web3, 

 of our latest Live Bug Bounty marathon, this time with L’Oreal, which took place at LeHack in Paris over the weekend.

Read this monthly roundup of content aimed at ethical hackers even sooner by subscribing to 

Are you a CISO, other security professional or security-conscious dev? Check out our CISO-focused sister newsletter, 

 – bringing you news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

Sam Curry modem masterclass, PHP threat to Windows Servers, Calls for AI safety Bug Bounties – ethical hacker news roundup

YesWeHack has migrated its platform architecture to a private cloud service that is fully compliant with SecNumCloud, a super-stringent security qualification overseen by France’s cybersecurity agency.

This effectively means YesWeHack now enjoys protections for sensitive data, and against downtime, at elevated levels intended for government agencies and critical infrastructure.

Moreover, our customers’ data will continue to be stored only within the EU thanks to SecNumCloud’s rigorous rules around data sovereignty.

The SecNumCloud-qualified service is now provided by Infrastructure-as-a-Service (IaaS) specialist OVHcloud, which was named the European leader in the hosted private cloud market in 2020 by market research firm Forrester.

The SecNumCloud initiative was launched in 2013 by ANSSI, the French cybersecurity agency, to protect the data being outsourced to third parties in increasing volumes by government entities and critical national infrastructure.

have been instructed to choose only SecNumCloud (or other European equivalent)-qualified providers

 when seeking commercial cloud storage for highly sensitive data.

As such, the qualification has extremely demanding criteria that offers high levels of assurance to any customer, whatever their sector or risk profile.

SecNumCloud could soon be succeeded by an equivalent EU-wide scheme, the proposed EUCS (European Cybersecurity Certification Scheme for Cloud Services). However, since the EUCS has been partly modelled on the French scheme, SecNumCloud-qualified providers will have a huge head start on non-qualified providers in gaining EUCS qualification.

 (PDF) comprises 360 security requirements, covering areas such as information security and risk management, encryption mechanisms, incident response and business continuity.

A multi-stage qualification process begins with a rigorous audit of security policies and controls. The cloud provider must then implement any recommendations made after the audit. Qualification is attained following a final audit and ANSSI validation.

This exhaustive process must be repeated every three years to renew qualification, with annual audits in between validating ongoing compliance. 

Only six providers have achieved qualification so far

SecNumCloud prescribes that providers must be headquartered, and store and process data, within the EU. It also precludes majority foreign-owned providers from being SecNumCloud-qualified.

YesWeHack’s own strict compliance with the EU’s strict security and data privacy laws offers strong assurance to EU- and non-EU customers alike. YesWeHack also recently gained 

CREST accreditation for pentesting services

 and ISO/IEC 27017, the cloud security certification.

Founded in France in 1999, OVHcloud provides secure, reliable and eco-friendly cloud services in 140 countries.

 study, OVHcloud notched the highest possible scores in role-based access control and several criteria specific to hosted private clouds. As a 

, it offers strict EU data sovereignty, a zero-trust model and round-the-clock uptime through a disaster recovery plan.

YesWeHack's partnership with OVHcloud is not new since we already used other services provided by the company. Our positive experience with OVHcloud helped to make them the standout candidate among SecNumCloud-qualified providers.

While using a SecNumCloud-qualified service was not mandatory for YesWeHack, migrating our platform architecture to one aligns with our foundational commitment to trust.

“The YesWeHack platform processes and stores sensitive information about digital assets and vulnerabilities for customers in a wide range of industries, including government entities and critical infrastructure. Moreover, the modern threat landscape dictates that your supply chain must be as secure as your internally controlled infrastructure,” says YesWeHack CEO and founder Guillaume Vassault-Houlière.

“In this context, continuing to partner with OVHcloud was a no-brainer. OVHcloud’s Secnumcloud qualification and peerless reputation for security, uptime, agility and innovation significantly strengthens our security posture and validates the trust customers place in us.”

Will there be any disruption for YesWeHack customers?

 was sufficient to carry out the migration with minimal disruption to users, thanks to our Infrastructure-as-Code (IaC) and real-time data replication processes, which allowed every component supporting our platform to be quickly respawned and set up in the IaaS. Everything is now running normally.

Would you like to know more about the YesWeHack Bug Bounty and Vulnerability Management Platform? Feel free to 

Critical infrastructure-level protections for YesWeHack cloud after switch to SecNumCloud-qualified service

’s reported decision not to pay out for several significant zero-days was one of three Bug Bounty disclosures with unexpected twists we spotted in the media recently.

The quartet of iOS bugs were apparently linked to a zero-click exploit allegedly used to spy on employees of the company reporting the vulnerabilities, as well as diplomats from a particular country.

The plot thickens when that country turns out to be Russia and the reporter of the bugs is 

, Kaspersky said Apple cited “the dedicated policy” with no further explanation for not paying out for the firm's Bug Bounty submission. 

The head of research at Kaspersky, whose antivirus software has been 

 amid US-Russia geopolitical tensions, said the company would have donated the rewards to charity.

This, by the way, is our inaugural monthly roundup of offensive security insights curated for CISOs, security teams and security-conscious devs (this was first published on our 

Another interesting Bug Bounty disclosure – but with no geopolitical dimension this time – is a ‘vulnerability’ in 

 for which the tech giant paid a reward, but then decided did not quite meet the threshold qualifying it as a vulnerability after all.

The issue “allows an attacker to bypass firewall rules based on Azure Service Tags by forging requests from trusted services”, 

, Tenable said Microsoft initially developed a “comprehensive fix”, but later decided the issue centred on the “inherent risk in using Service Tags as a single mechanism for vetting secure network traffic” and was best resolved with an 

The third, and most bizarre, disclosure saw Web3 security outfit 

after the cryptocurrency exchange’s CSO 

 an unnamed “security researcher” of extortion, and said it was “coordinating with law enforcement agencies” over the issue.

After unmasking itself as the reporter of a related vulnerability to Kraken’s Bug Bounty Program, Certik insisted its researchers had acted as good-faith white hats and 

 of events that left Kraken (named after a mythical giant octopus) apparently unhappy about Certik's conduct.

In other Bug Bounty news of note, Firefox developer 

 program focusing on large language models (LLMs) and other deep learning technologies. And 

 in capture-the-flag competitions and Bug Bounty Programs and how the Chinese government could leverage their endeavours.

did not foresee the backlash to a new AI feature that 

 of your PC in order to create an instantly searchable database of everything you’ve ever done on your computer.

 from the launch of its Copilot+ PCs – it will now only be rolled out for devs and techies to play with as part of its Windows Insiders Program. It’s a serious misstep by Microsoft, which has mostly outflanked its rivals in the LLM arms race since it unleashed ChatGPT in 2022.

On the vulnerability front, a security flaw in the 

 file transfer tool is worth paying attention to after its severity was 

elevated from ‘high’ to ‘critical’

MOVEit developer Progress Software is urging customers to patch CVE-2024-5806 after a “newly identified vulnerability in a third-party component used in MOVEit Transfer elevates the risk of the original issue”. 

 attackers to exfiltrate, delete or change data on the MOVEit Transfer server. The bug has surfaced 12 months after a previous MOVEit vulnerability was blamed for a 

National Institute of Standards and Technology (NIST)

 has revealed a potential solution to a CVE backlog in processing new vulnerability reports. NIST said it has hired an external vendor to help process soaring numbers of vulnerabilities added to the National Vulnerability Database (NVD), 

 has marshalled arguments in favour, as well as exploring the possible risks, of 

amid the ballooning responsibilities of the role. Jon Oltsik, analyst emeritus with Enterprise Strategy Group, suggested that one executive could work the board, regulators and insurers and must be “fluent in the language of the business and translate that into cyber risk”.

Another could oversee the increasingly complex technology side – most notably the rapid adoption of AI. “Having someone who really understands all of that technology and can put the right controls in place with guidance from the business, is a different type of role,” Oltsik told CSO Online.

One of the UK’s worst-ever cyber-attacks

One of the worst-ever cyber-attacks against a UK organisation saw massive disruption to 

 and publication to the darknet of a huge trance of sensitive personal data.

The attack on NHS pathology provider Synnovis disrupted more than 3,000 appointments at hospitals and medical practices using its services.

The Qilin ransomware gang, which is suspected of being Russia-based, has claimed responsibility. 

 that a sample of data it saw included patient names, dates of birth, NHS numbers and descriptions of blood tests. Security experts have expressed concern that the stolen data gives cybercrooks ammunition to extort affected patients.

Another large-scale attack against the healthcare sector, this time in the US, could potentially involve the theft of highly sensitive personal data of 

Pennsylvania-based healthcare provider Geisinger 

 a November breach on Microsoft-owned speech recognition firm Nuance Communications after it failed to revoke corporate file access from an employee who had been sacked.

A problem with open source vulnerabilities?

 in relation to vulnerability disclosure in an article about 

Common Misconceptions about CVEs, NVD, KEV Catalog, and EPSS

Security researcher Kyle Kelly wrote: “Many security tools use the NVD as their sole source of security advisories”, yet “open-source maintainers frequently publish security advisories on alternative platforms like the GitHub Advisory Database”. He added: “This is not good if you care about open-source vulnerabilities.”

In positive news for open source security, applications are open to 

, which helps critical and under-resourced open source projects prevent and patch vulnerabilities through reducing technical debt, secure code audits and Bug Bounty. The impressive initiative is operated by the Sovereign Tech Fund, which runs four public programs through YesWeHack: for 

We’ve also seen useful articles on best practices from reputable sources on 

 (a podcast interview with GitHub CISO Mike Hanley) and on the 

, with tips and useful resources for implementation.

Read this monthly roundup even sooner by subscribing to 

 – our LinkedIn newsletter curating news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

Are you a bug hunter or do you have an interest in ethical hacking? Check out our ethical hacking-focused sister newsletter, 

 – offering hunting advice, interviews with hunters and CTF-style challenges, among other things.

Apple declines to pay Kaspersky vuln reward, Bug Bounty ‘extortion’ dispute, Microsoft Recall backlash – OffSec roundup for CISOs

invited participants to exploit a path traversal (CWE-22) vulnerability

and read a file containing the challenge flag.

We are delighted to announce the winners of Dojo Challenge #33 below.

Want to create your own monthly Dojo challenge? Send us a message on Twitter!

 feeds to be notified of upcoming challenges.

Read on to find out how one of the winners managed to solve the challenge.

We asked you to produce a qualified report explaining the logic allowing exploitation, as set out by the challenge. 

To ensure contestants actually solved the challenge themselves rather than copy-pasting the answer from elsewhere.

To determine contestants' ability to properly describe a vulnerability and its vectors within a professionally redacted report. This gives us invaluable hints on your unique talent as a bug hunter.

We want to thank everyone who participated and reported to the Dojo challenge. Many other high quality reports were submitted alongside those of the three winners. 😉

Below is the best write-up overall. Thanks again for all your submissions and thanks for playing!

 occurs when an application uses external data (e.g., user input) to identify a file or directory located under a restricted root directory, but does not properly control the elements entered by users, resulting in the interpretation of the resolution of a path name to a location external to the restricted root directory.

In other words, exploiting this vulnerability allows an attacker to read files 

 the current directory. This could lead to sensitive files being read.

Firstly, an application whose source code was accessible was identified. The purpose of this application was to enable users to display files within an HTML page via a form in which the file name was entered.

The first step in exploiting this application was to analyze the 

The following lines provide an initial source of important information. The application's current directory is set to 

. This means that the files included in the application should be in this directory:

The section of code following the first 5 lines configures a Jinja2 environment for template rendering, using the 

 directory as the template source, with an initial template named 

. This means that it is probably via this file that the contents of the other included files will be displayed:

The next part of the code indicates a function named 

. This function returns a variable of type 

, and takes as parameter a variable with name 

, corresponding to the file name specified by the user:

This function acts as an initial check on the data sent by the user:

 converts all uppercase letters within the variable f to lowercase. For example, "ExampLe" will become "example".

Thereafter, various checks are made via conditions:

if f.startswith("/") or f.startswith("file:///")

 variable begins with "/" or "file:///". If so, the function returns 

elif (“127” in f) or (“localhost” in f)

The YesWeHack Blog

L'Oréal lauds live Bug Bounty success at LeHack 2024

Sam Curry modem masterclass, PHP threat to Windows Servers, Calls for AI safety Bug Bounties – ethical hacker news roundup

Critical infrastructure-level protections for YesWeHack cloud after switch to SecNumCloud-qualified service

L'Oréal lauds live Bug Bounty success at LeHack 2024

Apple declines to pay Kaspersky vuln reward, Bug Bounty ‘extortion’ dispute, Microsoft Recall backlash – OffSec roundup for CISOs

Dojo challenge #33 winners!

Countdown to NIS 2 compliance: Key insights and implications for your SecOps strategy

Apple declines to pay Kaspersky vuln reward, Bug Bounty ‘extortion’ dispute, Microsoft Recall backlash – OffSec roundup for CISOs

YesWeHack lève 26 millions d'euros pour accélérer sa croissance et son expansion internationale

YesWeHack raises 26 million euros to accelerate its growth and international expansion

‘Our businesses are reassured that we’re protecting their activities’: Les Mousquetaires CISO on leveraging live hacking events

YesWeHack lève 26 millions d'euros pour accélérer sa croissance et son expansion internationale

DON'T WAIT FOR THE THREATS TO STRIKE

Products

Researchers

Resources

Company

Follow us