{"id":228,"date":"2017-03-08T00:56:01","date_gmt":"2017-03-08T00:56:01","guid":{"rendered":"http:\/\/information-biosecurity.org\/?p=228"},"modified":"2019-07-09T01:04:07","modified_gmt":"2019-07-09T01:04:07","slug":"vulnerabilities-in-dnalims","status":"publish","type":"post","link":"https:\/\/information-biosecurity.org\/index.php\/2017\/03\/08\/vulnerabilities-in-dnalims\/","title":{"rendered":"Vulnerabilities in dnaLIMS"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Shorebreak Security reported issues with dnaLIMS:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>An unauthenticated attacker has the ability to <strong>execute system commands<\/strong>\u00a0in the context of the web server process,\u00a0<strong>hijack active user sessions<\/strong>,\u00a0<strong>retrieve system files<\/strong>\u00a0(including the plaintext password file), and\u00a0<strong>inject untrusted html or JavaScript<\/strong>\u00a0into the dnaLIMS application. An attacker could use these vulnerabilities together in order to gain control of the application as well as the operating system hosting the dnaLIMS software. <\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">dnaLIMS was informed but apparently did not fixed the issues.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.shorebreaksecurity.com\/blog\/product-security-advisory-psa0002-dnalims\/\">https:\/\/www.shorebreaksecurity.com\/blog\/product-security-advisory-psa0002-dnalims\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<div class=\"mh-excerpt\"><p>Shorebreak Security reported issues with dnaLIMS: An unauthenticated attacker has the ability to execute system commands\u00a0in the context of the web server process,\u00a0hijack active user <a class=\"mh-excerpt-more\" href=\"https:\/\/information-biosecurity.org\/index.php\/2017\/03\/08\/vulnerabilities-in-dnalims\/\" title=\"Vulnerabilities in dnaLIMS\">[&#8230;]<\/a><\/p>\n<\/div>","protected":false},"author":1,"featured_media":229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2],"tags":[87,88,89,86],"class_list":["post-228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cases","tag-hacking","tag-lims","tag-web","tag-whitehat"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/information-biosecurity.org\/wp-content\/uploads\/2019\/07\/shoreline.jpg","_links":{"self":[{"href":"https:\/\/information-biosecurity.org\/index.php\/wp-json\/wp\/v2\/posts\/228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/information-biosecurity.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/information-biosecurity.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/information-biosecurity.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/information-biosecurity.org\/index.php\/wp-json\/wp\/v2\/comments?post=228"}],"version-history":[{"count":1,"href":"https:\/\/information-biosecurity.org\/index.php\/wp-json\/wp\/v2\/posts\/228\/revisions"}],"predecessor-version":[{"id":230,"href":"https:\/\/information-biosecurity.org\/index.php\/wp-json\/wp\/v2\/posts\/228\/revisions\/230"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/information-biosecurity.org\/index.php\/wp-json\/wp\/v2\/media\/229"}],"wp:attachment":[{"href":"https:\/\/information-biosecurity.org\/index.php\/wp-json\/wp\/v2\/media?parent=228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/information-biosecurity.org\/index.php\/wp-json\/wp\/v2\/categories?post=228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/information-biosecurity.org\/index.php\/wp-json\/wp\/v2\/tags?post=228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}