Generous bounties, technically stimulating scopes and the feel-good factor of helping to secure critical infrastructure that underpins a free and open internet – sound appealing, bug hunters?

You can enjoy these benefits by hunting on the seven (so far) public Bug Bounty Programs operated by the Sovereign Tech Fund (STF), which invests in open digital infrastructure to ensure a resilient and sustainable open source ecosystem.

Your hacking skills, together with support from the STF, are particularly invaluable to these volunteer-run open source projects, given their vital role infrastructurally or for critical dependencies. Just consider the downstream impact of the 

 to see the importance of effective vulnerability management in this realm.

Java logging framework, is now among the STF’s Bug Bounty Programs, alongside 

All seven programs are currently offering rewards up to 

 for critical vulnerabilities. High-severity flaws command bounties up to €5,000, while for medium severity it’s €3,000 and low-severity issues earn €500 rewards.

The generous bounties – among the highest on YesWeHack – reflect the unusual and challenging nature of many of the targets. Scroll down and check out these programs to see if the scopes align with your hacking expertise.

Tara Tarakiyee, a technologist at the STF, comments: 

“Our societies increasingly rely on open source software as critical infrastructure, and it takes a lot of effort to keep that infrastructure safe. Which is why STF is committed to fostering the community of security researchers looking to use their skills to secure the open source ecosystem in the public interest through programs like the 

Open-source Bug Bounty Programs from the Sovereign Tech Fund

These seven public Bug Bounty Programs are currently active. With the Sovereign Tech Fund having numerous active investments – also including Drupal, PHP, Fortran, GNU libmicrohttpd and Python Package Index – and on the lookout for more, the organisation may well be a source of new hunting opportunities in the not-too-distant future.

The site of arguably the most significant vulnerability of all time – Log4Shell – owing to its severity and the ubiquity of this Java logging framework. 

 comprises an API, its implementation, and components to facilitate deployment for various use cases.

Qualifying vulnerabilities (at the time of writing): 

log injections, log event loss, memory safety, remote code execution, deadlocks, DoS.

 for up-to-date scopes, qualifying/non-qualifying vulnerabilities and other rules.

A suite of basic building blocks for a Linux system. Among other features, 

 provides aggressive parallelisation capabilities, socket and D-Bus activation for starting services, on-demand starting of daemons, tracking of processes using Linux control groups, maintenance of mount and automount points, and implementation of transactional, dependency-based service control logic.

UEFI SecureBoot bypasses, remote code execution, remote denial of service, local and unprivileged denial of service, privilege escalation, sandboxing bypass, login prompt/password check bypass, disk encryption keys leaks, misuse of cryptographic primitives, leaking user logs to other unprivileged users, and signed dm-verity compromise.

Fully featured desktop environment and application platform for Linux. Used with the likes of Ubuntu, Fedora, RHEL and Tails and in security-critical contexts by activists, journalists, corporations and governments, among other users. The 

 Bug Bounty Program began with two critical scopes, GLib and libsoup, but there is enormous scope for growth with the GNOME desktop consisting of hundreds of modules.

Memory safety issues, denial of service, undefined behavior leading to a security vulnerability, race conditions, missing validation of untrusted inputs, privilege escalation, cryptographic problems, exfiltration of confidential material, and supply chain issues.

 is an open-source implementation of the Network Time Protocol written in Rust, with support for the Network Time Security protocol and a focus on exposing minimal attack surface.

Qualifying vulnerabilities (at the time of writing):

 Remote code execution; remote denial of service (excluding protocol limitations); privilege escalation; misuse of cryptographic primitives; and arbitrary clock modifications, using only NTS sources, controlling at most a minority of the NTS sources.

 is a JavaScript library implementing the OpenPGP standard for message encryption and signing. OpenPGP is typically used for end-to-end encrypted email, signing of git commits and software releases, and encrypted file storage, among a variety of other applications.

 Where OpenPGP.js: incorrectly encrypts a message, causing (part of) it to be decryptable by an attacker; uses an insecure algorithm (by default) to encrypt a message, causing (part of) it to be decryptable by an attacker; incorrectly decrypts or signs the message, causing (part of) the private key to be extractable by an attacker; returns unauthenticated data (by default), potentially causing EFAIL-style vulnerabilities; incorrectly verifies an invalid signature; fails to parse a compliant OpenPGP public key, possibly causing the application or user to send the message in cleartext instead.

 provides secure communication and authentication in the OpenPGP arena. “We are committed to protecting the privacy and security of our users with a particular emphasis on the most vulnerable people in our society: activists, journalists, lawyers and their clients,” reads the program introduction.

Memory safety issues, denial of service, undefined behaviour leading to a security vulnerability, injection attacks into human-readable and machine-readable output, authentication bypasses, creation of cryptographic artifacts using high-level interfaces that break or undermine the properties of cryptographic algorithms, invalid reasoning about OpenPGP certificates, exfiltration of confidential material, diversion of packet streams with respect to another major OpenPGP implementation, improper use of cryptographic primitives, and improper handling of secret key material.

 is a project to read, write and generate CycloneDX SBOMs. It comprises cyclonedx-bom, a Rust library for reading and writing CycloneDX SBOMs from/to Rust structs, and cargo-cyclonedx, a Rust application that leverages cyclonedx-bom to generate CycloneDX SBOMs for Cargo-based Rust projects.

 Remote code execution, remote denial of service, local and unprivileged denial of service, privilege escalation, memory safety issues, sandbox or security boundary bypass, arbitrary file read/write operations, code injection vulnerabilities, insecure deserialization, cryptographic implementation flaws, integrity check bypass, dependency resolution vulnerabilities, exposure of sensitive information in logs, compromise of signed SBOMs (e.g., signature verification failures), manipulation of SBOM content leading to incorrect or incomplete data, misconfiguration vulnerabilities, and insecure handling of command-line arguments and environment variables.

 invests in open digital infrastructure projects in order to strengthen open source security, resilience and technological diversity. Founded in 2022, the fund is financed – to the tune of €17 million for 2024 – by the German Federal Ministry for Economic Affairs and Climate Action.

 in 2023 to help time-poor open source maintainers prevent and patch vulnerabilities through technical debt reduction, secure code audits and Bug Bounty Programs managed by YesWeHack. 

, meanwhile, saw an initial three successful applicants – developers, contributors or maintainers – given €300,000 to spend on creating or improving developer tooling, production security mechanisms and project documentation for their Free and Open Source Software (FOSS) components over a four- or eight-month period. The Sovereign Tech Fund is also piloting a 

 under which overworked and hitherto unpaid maintainers of critical open source components will be paid for their work.

These are important initiatives when you consider how, according to 

, 96% of codebases contain open source, applications have 526 open source components on average, and 84% of codebases contain at least one open source vulnerability.

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

object relational mapper (ORM) leak vulnerabilities

 by Elttam kicks off our latest roundup of InfoSec news and hacking writeups.

ORM leak flaws apparently occur when ORMs fail to validate user inputs, potentially resulting in the exposure of sensitive data. 💻 

 of Elttam’s research – described as “super-interesting” with “tons of potential for further research” 

 – focuses on the Django ORM and relational filtering attacks. 

, “a beautiful example of abusing framework features to make timing attacks that work in the wild”. 🔥

, meaning moderators have deemed the research truly novel in the realm of web security. 🚀

The same applies to Doyensec research that discovered that cross-site request forgery (CSRF) remains a viable vector in today’s applications despite browsers having been considerably hardened against CSRF (notably through 

). 🧐 The vulnerability research firm successfully 

client side path-traversal “to resuscitate CSRF

 for the joy of all pentesters” and unearth vulnerabilities in major web messaging applications, 

wrote Doyensec researcher Maxence Schmitt

. The research is documented more extensively in a whitepaper and has spawned a 

 “that provides advanced capabilities and automation for finding and exploiting Client-Side Path Traversal”. 👌

Other groundbreaking research to satisfy the exacting criteria of r/websecurityresearch recently includes: 

extending browser extension messaging chains with native messaging to achieve ‘universal code execution’

; Doyensec’s Viktor Chuchurski on how inadequate concurrency control in databases can 

“that is often overlooked by pentesters”, 

Assetnote co-founder and CTO Shubham Shah, meanwhile, 

 to be “one of the most critical exploit chains in the history of @assetnote”, no less. 😮 The researcher in question praised ServiceNow’s security team as being “excellent to work with” in securing the more than 40,000 potentially affected instances.

 writeup from 15-year old (!!!) researcher 

, specifically leading ‘from PDF.js font-injection to All-platform Electron exposed ipcRenderer with listened BrokerBridge RCE’; PortSwigger’s Zakhar Fedotkin showing “

abuses widget annotations to create render discrepancies

, and share the code so you can generate your own”; Sonar’s Stefan Schiller on the value of

 when serving HTML documents to reduce the risk of XXS bugs; and ‘

how we discovered the AWS Organization ID for any AWS Account

’ from the CTO and co-founder of Tracebit. 😎

Over in LLM world, a former Apple engineer has 

 “an almost complete lack of bug reporting infrastructure from the LLM providers” after documenting his efforts to report a delirium-inducing prompt that he dubbed “LLM kryptonite”. 🦸 In a 

, Mark Pesce had recounted how he had induced “every chatbot I could access” bar Anthropic’s Claude 3 Sonnet into descending into a “

, LLM vendors came under fire for apparently declining to acknowledge issues while surreptitiously deploying “behind-the-scenes patches”. 😲

As well as hosting a live Bug Bounty with L’Oreal 💄 (see the highlights video below or 

), YesWeHack had a booth at leHACK in Paris last month and can relay some interesting insights from the conference track at France’s biggest hacker con.

 and thinker on InfoSec, cyber warfare and internet privacy, was reassuring on the topic of 

resisting manipulation by AI and malign online actors

If humans seem increasingly helpless to resist their minds being 'hacked' by ever-more sophisticated algorithms, then who better to show how to fight back than the human hackers? 

Schwartau said a cybersecurity mindset could inoculate us against the algorithmic manipulations that keep us scrolling, clicking and feeling negative emotions – anger, disgust – that most effectively drive social media ‘stickiness’. 

“Apply cybersecurity to it and there is hope,” he said. The speaker urged humanity to “take a pause” and engage in slow, deliberate and conscious 

. 🧠 He also recommended resources for building resilience against misinformation and disinformation, such as the 

. Schwartau also lamented how while the UK and EU have numerous studies or initiatives on countering misinformation, the US has none – the most recent, the Stanford Internet Observatory, had closed down. 😯

, a lock-picker extraordinaire, offered some fascinating insights into the vulnerabilities of physical locks. 🔒 

How many of the lessons he drew apply to digital security? “Always look for simple solutions to what look like complex problems” when vuln hunting for instance. “Clever does not mean secure,” is another. The author of a 

 bemoaned a “lack of imagination by design engineers and red teams”. 🧐

Tobias played several videos of himself and others 

defeating high security locks within minutes or even seconds

defeating a Kryptonite bike lock with a ballpoint pen

. Tobias has also featured on an NBC Today segment on lock-picking in 2009, as you can see below. 👇 

 warned that only a ‘response in kind’ could adequately tackle the threat of 

machine learning supercharging malware development and distribution

. The former assistant professor of computer science at the US Air Force Academy noted that VirusTotal reports a daily submission of two million malware samples, around one million of which are unique – a challenge traditional detection mechanisms are hopelessly ill-equipped to address. 

Sonywa demoed a research project that used machine learning “to provide enhanced classification of an entire 200+ gigabyte-malware family corpus consisting of 80K+ unique malware samples and 70+ unique malware families.” 👏

prevalence, usefulness and drawbacks of neuro-divergence in InfoSec

. In ‘a praise to laziness (or why hackers are awesome people)’, 

 said laziness had motivated inventions as significant as washing machines, balance bikes and neural networks. The pen tester-turned-hacker, who has ADHD, admitted being too ready to abandon promising projects when he reached seeming dead ends, but said his low tolerance for boredom has driven him to create tools to automate the most tedious tasks. 🧐

We also have some new hacking resources to announce… Our newest addition to our Dojo platform, for instance, is the second of four new WAF bypassmodules, this time focused on 

Our latest technical guide, meanwhile, centres on 

white-box penetration testing with Xdebug

, specifically explaining how to: configure a PHP web application within a docker environment; set up Xdebug; detect PHP vulnerabilities using this PHP debugger; and create custom payloads to deploy in black-box engagements.

Kudos also to the winners of our latest monthly CTF challenge, 

, which involved exploiting an XXE vulnerability.

 of our Bug Bounty leaderboard. 👏 Check out our video interview with Xel from last year. 👇 As for the 

 is top of the pile (and the all-time leader), followed by 

Read this monthly roundup of content aimed at ethical hackers even sooner by subscribing to 

Are you a CISO, other security professional or security-conscious dev? Check out our CISO-focused sister newsletter, 

 – bringing you news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

The first three stories in our monthly CISOs roundup (first published in our 

 newsletter) are all related to risks posed by society’s hyper-reliance on relatively few digital systems.

Securities and Exchange Commission (SEC) lawsuit brought against SolarWinds

 and its CISO in relation to the Sunburst cyber-attack. The far-reaching impact of that 2020 incident shows why security failures are increasingly treated with similar seriousness to, say, health and safety scandals.

The Sunburst attack, to remind readers, was a highly sophisticated software supply chain attack that resulted in the compromise of 18,000 customers, including Cisco, Microsoft and the US government, via a vulnerability in a SolarWinds component.

“CISOs have little reason to celebrate” the dismissal recently of all but one of the charges brought against the Texas-based firm over the incident, 

. That’s because the remaining charge – securities fraud – is the most serious. 

Reassuringly for CISOs, Brian Levine, a former federal prosecutor, told CSO Online that the SEC was unaccustomed to having its charges thrown out, and speculated that they might be more circumspect about launching similar lawsuits in future. Given the remaining charge relates to security claims made prior to the attack, he also suggested CISOs should think twice about making public statements about their security, especially when “you don’t get much credit for making them” anyway.

Meanwhile, in the InfoSec world beyond YesWeHack, the 

 was not technically a security failure, but the worst-ever global IT outage involves a security vendor and offers salutary lessons about a security fundamental: risk mitigation.

First, to return to our central thread, there's the risk of everyone, everywhere relying on the same few applications for critical functions. CrowdStrike itself accounts for 24% of the endpoint protection market. Ironically, a CrowdStrike executive 

 (before the outage) of the risk of using a “single provider for operating system, cloud, productivity, email, chat, collaboration, video conferencing, browser, identity, generative AI, and increasingly security as well”.

Responding to the crisis that erupted last month, Kevin Beaumont, a well-regarded security researcher, wrote that “CrowdStrike overall reacted really well”, but said “the incident highlights a bunch of wider concerns”.

 about the incident, Beaumont advised organisations to demand that their vendors: “Provide more transparency about how endpoint security updates are tested and rolled back”; disclose “potentially risky interactions with the Windows kernel, and develop a roadmap to safer drivers”; be more transparent about their own security; “disclose, in advance, if they are subject to national security laws” that could compel them to “allow access to customer data”; and publish a post-mortem for bad updates “with full transparency explaining what happened, why it happened, and steps taken to remediate”. 🧐

 at least showed there is a viable, analogue Plan B to ensure (partial) business continuity during digital meltdowns (always have a pen to hand!). 

Many experts are also concerned at the pace at which Large Language Models (LLMs) are being built into applications performing all manner of tasks. In light of their growing ubiquity, it’s alarming that a tech expert managed to induce “every chatbot I could access” – with the sole exception of Anthropic's Claude 3 Sonnet – into descending into a “

” with a prompt that he dubbed “LLM kryptonite”. 🤪

 (see video below), his prompt was too dangerous to expose to prying eyes. And yet, Mark Pesce, a VR innovator and ex-Apple engineer, encountered “an almost complete lack of bug reporting infrastructure from the LLM providers”, according to a piece he 

, Pesce said Microsoft had deemed that the bug “does not meet the definition of a security vulnerability”, and noted how some LLM vendors apparently failed to acknowledge issues while surreptitiously deploying “behind-the-scenes patches”.

, purveyor of high quality web security research, has recently recommended 

 when serving HTML documents to reduce the risk of XXS bugs, and detailed 

, a popular open-source solution for hosting and managing source code, together with advice on protecting instances.

Other notable writeups includes a Phylum analysis of North Korean threat actors 

, and an Evasec investigation of vulnerabilities in the 

dependency manager that allows malicious actors to claim ownership of thousands of unclaimed pods and insert malicious code into 

Novel attack techniques that combine vulnerabilities found in dozens of 

are allowing threat actors to spoof emails from more than 20 million domains of trusted organisations, according to 

 ahead of its presentation at Black Hat USA next week.

Read this monthly roundup even sooner by subscribing to 

 – our LinkedIn newsletter curating news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

Are you a bug hunter or do you have an interest in ethical hacking? Check out our ethical hacking-focused sister newsletter, 

 – offering hunting advice, interviews with hunters and CTF-style challenges, among other things.

Partial SolarWinds reprieve, CrowdStrike lessons, LLM kryptonite – OffSec roundup for CISOs

invited participants to exploit a XML external entity (XXE) injection (CWE-611) vulnerability

and read a file containing the challenge flag.

We are delighted to announce the winners of Dojo Challenge #34 below.

Want to create your own monthly Dojo challenge? Send us a message on Twitter!

 feeds to be notified of upcoming challenges.

Read on to find out how one of the winners managed to solve the challenge.

We asked you to produce a qualified report explaining the logic allowing exploitation, as set out by the challenge. 

To ensure contestants actually solved the challenge themselves rather than copy-pasting the answer from elsewhere.

To determine contestants' ability to properly describe a vulnerability and its vectors within a professionally redacted report. This gives us invaluable hints on your unique talent as a bug hunter.

We want to thank everyone who participated and reported to the Dojo challenge. Many other high quality reports were submitted alongside those of the three winners. 😉

Below is the best write-up overall. Thanks again for all your submissions and thanks for playing!

A XXE (XML External Entity) vulnerability occurs when an application allows an attacker to include insecure external entities in an XML document.

This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.

Vulnerable applications may include web services, applications that use XML documents for data processing, or any workflow that improperly controls XML data.

We are presented with a web application giving us a prompt in order to give our input to an AI generating images. We can either directly give it a theme or input a base64 string of an XML file.

When we analyze the source code, we notice the 

 function, which we're going to focus on:

One line catches instantly our attention:

parser.setFeature(xml.sax.handler.feature_external_ges, True)

Indeed, this line of Python code is used to configure the XML parser to allow the processing of external general entities (external general entities are entities declared outside the DTD (Document Type Definition) of an XML document).

: is a method used to enable or disable certain features of the XML parser.

: is a predefined constant in the xml.sax.handler module that specifies the feature to allow external general entities.

This confirms that an XXE attack is possible on the web application if we manage to craft a malicious XML file.

if (dataBytes[:2] != b'\xff\xfe' and dataBytes[:2] != b'\xfe\xff'):

 checks for the presence of Byte Order Mark (BOM) signatures for UTF-16 little-endian (

). Here's the purpose of this verification:

 BOM signatures are used to indicate the encoding of a text file, especially for UTF-16. 

 signifies that the text is encoded in UTF-16 little-endian, while 

 signifies that the text is encoded in UTF-16 big-endian.

 By checking these signatures, the code ensures that the data it processes is not encoded in UTF-16. If the data were UTF-16 encoded, it would require special handling to be correctly decoded. The absence of these signatures allows the code to proceed under the assumption that the data is encoded in another format (likely UTF-8 or another encoding without a BOM).

 If the data were UTF-16 encoded but processed as another encoding, it could lead to processing errors or unexpected behaviors. By checking for and excluding UTF-16 encoded data, the code reduces the risk of such errors.

However, it appears that the code lacks explicit handling for data that contains a UTF-16 BOM. It would be prudent to add an else block to handle this situation if necessary, for instance, by returning an error or correctly decoding the UTF-16 data.

if any(x in dataBytes.lower() for x in [b'file://', b'tmp', b'flag.txt', b'system', b'public', b'entity']):

 checks for the presence of certain substrings within the decoded data. Here's the purpose of this verification:

Detection of Potentially Dangerous Content:

 This condition searches for specific keywords and substrings that could indicate dangerous or sensitive content. For example:  

 could be used to attempt file access or directory traversal.

 might refer to sensitive files or directories.

 could be related to critical system paths or publicly accessible areas.

b'entity' is relevant in the context of XML parsing and could be related to XML External Entity (XXE) attacks.

 By detecting these potentially dangerous substrings, the code can prevent the processing of malicious data that could lead to security vulnerabilities. For instance, an XXE attack might involve using external entities to access sensitive files, and this condition helps block such attempts.

 This check acts as an early warning system for malicious input, allowing the function to return 'BLOCKED' immediately if any of these keywords are found. This prevents further processing of potentially harmful data, reducing the risk of security breaches.

Overall, this condition helps enhance the security of the application by detecting and blocking potentially harmful content before it can be processed and cause damage.

The parser allows parsing of general entities.

A UTF16 little-endian of big-endian bypass the blacklist protection

In order to exploit the vulnerability, we then can take a classic XXE payload :

And use any program to encode it as UTF16 little-endian (or big), then encode it to base64 and feed it to application.

 binaries, on our XML file containing our payload:

Copy paste the result to the prompt of the application and verify the exploitation:

 file, we use the following XML payload :

In order to automate the task I wrote a script that automate the task, here is a demonstration :

XXE (XML External Entity) vulnerabilities pose significant security risks to systems. By exploiting these vulnerabilities, attackers can gain access to sensitive files on the server, execute remote code, or retrieve confidential data.
This can lead to privacy breaches, data integrity violations, or even complete compromise of the system. Vulnerable applications often include web services and other applications that handle XML data without properly controlling it, exposing these systems to significant risks of exploitation by malicious actors.

To protect against XXE (XML External Entity) vulnerabilities, we recommend following these measures:

 Configure XML processors to disable support for insecure external entities.

 Utilize secure XML libraries that implement protections against XXE attacks.

 Rigorously validate and filter all incoming XML data to eliminate unauthorized external entities and potentially malicious data.

 Ensure all XML libraries used are up-to-date with the latest security patches to mitigate risks.

 Educate developers and security teams on best practices for securing XML applications and web services.

By implementing these measures, you can effectively reduce the risks of XXE vulnerabilities in your applications and systems.

 - XML External Entity (XXE) Processing : https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing

 - Vulnerabilities affecting of the SAX parser : https://docs.python.org/3/library/xml.html#xml-vulnerabilities

Dojo challenge #34 winners!

Europe’s most successful ethical hackers and an iconic luxury fashion house proved an irresistible combination for our most glamorous Live Bug Bounty yet.

The YesWeHack Blog

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

ORM leaks, CSRF is alive, lockpicking lessons – ethical hacker news roundup

Partial SolarWinds reprieve, CrowdStrike lessons, LLM kryptonite – OffSec roundup for CISOs

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

Dojo challenge #34 winners!

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

White-box penetration testing with Xdebug: Debugging for PHP vulnerabilities

Dojo challenge #34 winners!

L'Oréal lauds live Bug Bounty success at LeHack 2024

Sam Curry modem masterclass, PHP threat to Windows Servers, Calls for AI safety Bug Bounties – ethical hacker news roundup

Critical infrastructure-level protections for YesWeHack cloud after switch to SecNumCloud-qualified service

L'Oréal lauds live Bug Bounty success at LeHack 2024

Don't wait for threats to strike

Produits

Chercheurs

Ressources

A propos

Suivez-nous