[CVE-2024-22243] URL Parsing Vulnerability in Spring Framework

TL;DR

During a routine pentest of a proprietary implementation, I discovered a URL-parsing vulnerability in the Spring Framework that facilitates host confusion, potentially resulting in open redirect or server side request forgery (SSRF). The finding has been officially designated as CVE-2024-22243. Additionally, I created an intentionally-vulnerable example implementation to demonstrate how this vulnerability might be exploited, as well as some Semgrep rules to help developers scan their code for potential vulnerabilities.

[CVE-2022-45028] Unauthenticated Stored XSS in the Arris NVG443B

Update: I reported this vulnerability to MITRE on November 4th, 2022. It has been assigned CVE-2022-45028 with a CVSS score of 6.1 (Medium).

Information Disclosure in a Cross-game Web API

Update: The vulnerable endpoint was fixed some time before September 7, 2022.

Scenario

I recently spent some time messing with Deus Ex: Mankind Divided, seeing as it's the latest (and possibly last) installment in one of my favorite video game series. At first I did a bit of reverse engineering on the game files; when I got bored of that, I decided to take a look at the game's network traffic. This led me to discover not only a player information disclosure, but techniques for cheating in the semi-online features. Highlights include:

• Unauthenticated access to player email addresses (if the victim has their platform account tied to their Square Enix account)
• The ability to obtain infinite premium currency
• The ability to view and modify other players' characters and inventories

This blog post specifically focuses on the player email disclosure vulnerability.