March 15, 2023

A quick writeup on how I was able to exploit Fortinet's heap overflow (CVE-2022-42475) :

Hi. Guy who worked in MSRC & shipped the MS17-010 patch here. *Preview pane* RCE was like the holy grail of non-OS vulns. This is so cool (the vuln, not the target because I will always #StandWithUkraine). But goddamn y’all better install this one. Trust me. I know.

Well, I'd argue the Outlook 0day has its limitations, although it seems to be a nation state 0day attack (see who reported it). It doesn't allow RCE but NTLM leaking. What I want to say is if ur org still allows outbound 139/445 connection, well, you already got bigger problems.