161 - XMPP Stanza Smuggling in Jabber and a Cobalt Strike RCE [Bug Bounty Podcast]

Several fun issues this week, from a Cobalt Strike RCE, a couple auth bypasses, and stanza smuggling in Jabber.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/161.html

[00:00:00] Introduction
[00:00:28] Sophos Firewall User Portal and Web Admin Code Injection [CVE-2022-3236]
[00:07:05] [Cisco Jabber] XMPP Stanza Smuggling with stream:stream tag
[00:14:52] Authentication Bypass & File Upload & Arbitrary File Overwrite
[00:25:31] Analysis of a Remote Code Execution (RCE) Vulnerability in Cobalt Strike 4.7.1
[00:33:38] HTTP/3 connection contamination: an …

bounty bug bug bounty cobalt cobalt strike jabber podcast rce smuggling strike xmpp