{"vulnerability": "cve-2021-35368", "sightings": [{"uuid": "1257ff22-ac5f-4dda-b68d-8055b49d77a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35368", "type": "seen", "source": "https://t.me/cibsecurity/31915", "content": "\u203c CVE-2021-35368 \u203c\n\nOWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-05T21:26:17.000000Z"}, {"uuid": "7afd84a3-b79b-4816-a5a5-e4f155f2f696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35368", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3808", "content": "#exploit\nCVE-2021-35368:\nCRS Request Body Bypass\nhttps://coreruleset.org/20210630/cve-2021-35368-crs-request-body-bypass", "creation_timestamp": "2024-09-10T16:52:02.000000Z"}, {"uuid": "1a368b73-d276-492a-a31f-4ab710265013", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35368", "type": "seen", "source": "https://t.me/cissp/3707", "content": "Threat Research\n1. Global Phishing Campaign Targets Energy Sector and its Suppliers\ud83d\ude04\nhttps://www.intezer.com/blog/research/global-phishing-campaign-targets-energy-sector-and-its-suppliers\n2. Tracking Cobalt Strike: A Trend Micro Vision One Investigation\ud83d\udc4d\ud83c\udffd\nhttps://www.trendmicro.com/en_us/research/21/g/tracking_cobalt_strike_a_vision_one_investigation.html\n\nRed Team Tactics\n1. Code Injection, Inject malicious payload via pagetables pml4\ud83d\ude04\nhttps://github.com/kkent030315/PageTableInjection\n2. VBA Stomping - Advanced Maldoc Techniques\nhttps://medium.com/walmartglobaltech/vba-stomping-advanced-maldoc-techniques-612c484ab278\n\nCode Property Graph (CPG) frontend for binary applications and libraries\nhttps://github.com/joernio/ghidra2cpg\n\nMalware analysis\nHackers Use New Trick to Disable Macro Security Warnings in Malicious Office Files\ud83d\ude0e\nhttps://thehackernews.com/2021/07/hackers-use-new-trick-to-disable-macro.html?m=1\n\nCVE-2021-35368:\nCRS Request Body Bypass\nhttps://coreruleset.org/20210630/cve-2021-35368-crs-request-body-bypass", "creation_timestamp": "2026-09-01T17:00:46.239184Z"}, {"uuid": "a8522a32-5b9b-4b5c-8dc3-eab66c4a2fc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35368", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3707", "content": "Threat Research\n1. Global Phishing Campaign Targets Energy Sector and its Suppliers\ud83d\ude04\nhttps://www.intezer.com/blog/research/global-phishing-campaign-targets-energy-sector-and-its-suppliers\n2. Tracking Cobalt Strike: A Trend Micro Vision One Investigation\ud83d\udc4d\ud83c\udffd\nhttps://www.trendmicro.com/en_us/research/21/g/tracking_cobalt_strike_a_vision_one_investigation.html\n\nRed Team Tactics\n1. Code Injection, Inject malicious payload via pagetables pml4\ud83d\ude04\nhttps://github.com/kkent030315/PageTableInjection\n2. VBA Stomping - Advanced Maldoc Techniques\nhttps://medium.com/walmartglobaltech/vba-stomping-advanced-maldoc-techniques-612c484ab278\n\nCode Property Graph (CPG) frontend for binary applications and libraries\nhttps://github.com/joernio/ghidra2cpg\n\nMalware analysis\nHackers Use New Trick to Disable Macro Security Warnings in Malicious Office Files\ud83d\ude0e\nhttps://thehackernews.com/2021/07/hackers-use-new-trick-to-disable-macro.html?m=1\n\nCVE-2021-35368:\nCRS Request Body Bypass\nhttps://coreruleset.org/20210630/cve-2021-35368-crs-request-body-bypass", "creation_timestamp": "2026-09-11T01:00:04.355941Z"}, {"uuid": "fcba52ff-749f-4c0a-9b3d-2c856b5ab39b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35368", "type": "seen", "source": "https://t.me/timcore_hacking/2786", "content": "#hackthebox\n#htb\n#hacking\n\nHackTheBox - Pikatwoo\n\n00:00 - Introduction\n01:00 - Start of nmap\n03:15 - Identifying all the technologies used in the box\n10:45 - Looking at OpenStack Keystone Authentication and discovering CVE-2021-38155\n12:15 - Pulling up API DOCS to see how to login to Keystone, then testing lockout\n14:00 - Taking the Burpsuite Request, sending it to FFUF and using a trick to try each password multiple times\n25:30 - Attempting to access Swift as a vendor to bypass auth, using GoBuster and discovering an Android directory with Pokatmon app in it\n35:10 - Start of analyzing the Pokatmon App, examining DNS, setting up a MITM with Burpsuite and Socat\n40:15 - Using Frida to disable TLS Certificate Pinning on Flutter\n45:20 - Discovering the App Signs every request, grabbing the certificate out of the app, and signing our own request\n49:20 - Performing an SQL Injection, getting an email address then looking for vulnerabilities in Forgot Password on the main website\n58:48 - Discovering CVE-2021-43557 in APISIX, which gives us an idea to URLEncode Paths to bypass blacklists and gaining access to the /private/ directory which has a /forgot-password we can use to reset Roger's password\n1:04:45 - Logging into the docs, gaining access to the API and finding an LFI\n1:09:45 - Looking into CVE-2021-35368, which is a ModSecurity Bypass that allows us to abuse the LFI\n1:18:10 - Using NGINX's temporary files with our PHP LFI to gain code execution\n1:27:55 - Shell returned on Pokatdex-API, exporting Kubernetes secrets\n1:34:20 - Discovering an APISIX admin key and exploiting this service by creating a route that executes code\n1:59:20 - Shell returned on the APISIX box, discovering credentials we can SSH with\n2:11:10 - Explioting the CRI-O with Kubernetes to set a kernel param to execute a script when a core dump is created (CVE-2022-0811)\n\n\nhttps://www.youtube.com/watch?v=gRj9Uz8_EOY", "creation_timestamp": "2023-09-14T12:26:19.000000Z"}, {"uuid": "ef45a6c6-c97d-4b6e-a5ed-f68e4f293801", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35368", "type": "published-proof-of-concept", "source": "https://t.me/timcore_hacking/2786", "content": "#hackthebox\n#htb\n#hacking\n\nHackTheBox - Pikatwoo\n\n00:00 - Introduction\n01:00 - Start of nmap\n03:15 - Identifying all the technologies used in the box\n10:45 - Looking at OpenStack Keystone Authentication and discovering CVE-2021-38155\n12:15 - Pulling up API DOCS to see how to login to Keystone, then testing lockout\n14:00 - Taking the Burpsuite Request, sending it to FFUF and using a trick to try each password multiple times\n25:30 - Attempting to access Swift as a vendor to bypass auth, using GoBuster and discovering an Android directory with Pokatmon app in it\n35:10 - Start of analyzing the Pokatmon App, examining DNS, setting up a MITM with Burpsuite and Socat\n40:15 - Using Frida to disable TLS Certificate Pinning on Flutter\n45:20 - Discovering the App Signs every request, grabbing the certificate out of the app, and signing our own request\n49:20 - Performing an SQL Injection, getting an email address then looking for vulnerabilities in Forgot Password on the main website\n58:48 - Discovering CVE-2021-43557 in APISIX, which gives us an idea to URLEncode Paths to bypass blacklists and gaining access to the /private/ directory which has a /forgot-password we can use to reset Roger's password\n1:04:45 - Logging into the docs, gaining access to the API and finding an LFI\n1:09:45 - Looking into CVE-2021-35368, which is a ModSecurity Bypass that allows us to abuse the LFI\n1:18:10 - Using NGINX's temporary files with our PHP LFI to gain code execution\n1:27:55 - Shell returned on Pokatdex-API, exporting Kubernetes secrets\n1:34:20 - Discovering an APISIX admin key and exploiting this service by creating a route that executes code\n1:59:20 - Shell returned on the APISIX box, discovering credentials we can SSH with\n2:11:10 - Explioting the CRI-O with Kubernetes to set a kernel param to execute a script when a core dump is created (CVE-2022-0811)\n\n\nhttps://www.youtube.com/watch?v=gRj9Uz8_EOY", "creation_timestamp": "2023-09-14T12:26:19.000000Z"}]}