227 - Kubernetes Code Exec and There Is No Spoon [Bug Bounty Podcast]

This week we've got a few relatively simple bugs to talk about along with a discussion about auditing and manually analysis for vulnerabilities.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/227.html

[00:00:00] Introduction
[00:00:23] Introducing the Microsoft Defender Bounty Program
[00:04:26] Tapping into a telecommunications company’s office cameras
[00:07:47] CrushFTP Critical Vulnerability CVE-2023-43177 Unauthenticated Remote Code Execution
[00:17:22] [Kubernetes] Ingress nginx annotation injection causes arbitrary command execution
[00:24:38] Testing for audits: there is no spoon

The DAY[0] …

analysis auditing bounty bug bug bounty bugs cameras code critical critical vulnerability crushftp cve defender introduction kubernetes microsoft microsoft defender microsoft defender bounty program office podcast program simple telecommunications there is no spoon unauthenticated vulnerabilities vulnerability week