Published Vulnerabilities

Security gap in search function of Bundeswehr web application patched

About some time ago, we had a look at the latest Bundeswehr website (https://www.bundeswehrkarriere.de/) in our lab. We noticed an error in the output of the validation of an application. We then investigated this error in more detail and in the end we were able to provide the Bundeswehr with an exploitable vulnerability in the area of Persistent Input Validation / Cross Site Scripting. After half a year has passed we would like to share this with you and will report about it here.

It all began with a notice of the announcement of the new digital updates at the Bundeswehr and the new career portal. After we talked several times in the office about the secure programming of the web agencies for the Bundeswehr, we wanted to see how the security of the public web portal really is.

Whitehat in action discovers Kiosk Escape & Escalation via Windows PasswordAgent

In the last few days some Whitehat hackers of the Vulnerability Lab have come together for an action at the station wilhelmshöhe in kassel (Germany) to deal with a new security hole of the Deutsche Bahn ticket machines. While the station woke up quietly at 05:00 in the early morning without security personnel, the action took place. In the first step of this article, we want to focus on the vulnerability and then explain our approach as a group.

It is possible for local attackers to break out of the kiosk mode of the Deutsche Bahn vending machine application if the Password Agent (PasswordAgent.exe) of the system receives a timeout or has a runtime error in the program itself in the background. These errors can occur due to aborted sessions, unclean logout or common errors when using the application at system level.