Rapid7 Blog

Rapid7 - https://rapid7.com - Full-Time - ONSITE - Torronto, Dublin Dublin Positions: Lead UX Designer, Senior Software Engineer - Architecture, Senior Software Engineer, Platform Delivery (devops) Toronto Positions: Platform Delivery (devops) https://www.rapid7.com/company/jobs.jsp The Dublin Positions are all focused on Logentries, which is a real-time log management and analytics service targeting mostly the DevOps and IT market expanding onto Security. If you are interested in scaling systems, search on unstructured data, handling log data at scale or are interested in migrating angular based applications to react send an email to [email protected] The Toronto Position Platform Delivery is a devops role, focused on helping the local teams to apply the best practices around deployments, release engineering and cloud infrastructure. Besides working on moving applications into AWS you will be also working on classical Release Engineering focused on on-prem software and their test and release process. The cloud stack consists mainly of Ruby, Chef, AWS, Cloudformation/convection, node etc. If you are interested in bringing best practices and patterns into our Toronto office reach out directly to me via [email protected]

You can read their actual disclosure policy here: https://www.rapid7.com/security/disclosure/ They do not -- and the industry as a whole does not -- claim that that the best practice is to immediately reveal a vulnerability regardless of a patch.

Rapid7 | Software Engineering (All Levels) | US, Canada, UK, Ireland | Full-Time | https://www.rapid7.com/careers/ Rapid7 helps organizations around the globe advance securely. Our technology, services, and community-focused research simplify complexity for security teams, helping them reduce vulnerabilities, monitor for malicious behaviour, investigate and shut down attacks, and automate routine tasks. With more than 9,000 customers across 120 countries, Rapid7 is a recognized leader in cybersecurity that has proudly earned numerous industry accolades and strong recognition for our technology and culture. Think we'd be a great fit for you? Apply on our jobs page or send me an email with the subject line "HN: Who is hiring" via adam (underscore) bunn (at) rapid7.com

Rapid7 | Austin, TX | Sr. UI Developer | Full Time, Onsite | http://www.rapid7.com Rapid7 is the leading provider of security risk intelligence solutions. Rapid7's integrated vulnerability management and penetration testing products, Nexpose and Metasploit, empower organizations to obtain accurate, actionable and contextual intelligence into their threat and risk posture. Rapid7's solutions are being used by more than 1,600 enterprises and government agencies in more than 65 countries, while the Company's free products are downloaded more than one million times per year and enhanced further by over 125,000 security community users and contributors. Rapid7 has been recognized as one of the fastest growing security companies worldwide by Inc. Magazine and is backed by Bain Capital Ventures. https://careers-rapid7.icims.com/jobs/2050/sr.-front-end-engineer/job

"In the past it has not been possible to serve SSL requests for multiple domains from the same IP address." This is a plain lie. This article just describes a technology that has been available for years: using Subject Alternative Names to declare all the host names in a single X.509 certificate. As far as I can tell, real CAs have been signing these types of certs for years (one random example: https://www.rapid7.com is valid for "www.rapid7.com" and "rapid7.com" without using a wildcard cert). The article call these certs "UCC SSL certs" but it is nothing more than a marketing name to sell Subject Alternative Names.

> but thanks to the vulnerable PQescapeString(), the following user_input would fuck it up Nope. To quote: https://www.rapid7.com/blog/post/2025/02/13/cve-2025-1094-postgresql-p… > Because of how PostgreSQL string escaping routines handle invalid UTF-8 characters, in combination with how invalid byte sequences within the invalid UTF-8 characters are processed by psql If you just pass it to postgres over a normal query, postgres will reject an invalid byte sequence in the query with an error, refuse to even parse the query, and thus you won't get a SQL injection. It's just that psql didn't hard-error on invalid utf-8, even though postgres did. That's why the escape function was suitable for postgres, both the escape function and postgres's query parser assume invalid byte sequences are, you know, invalid. > For parametrized queries, params don't go through serialization because they don't need to hit the parser, there's no "escaping" whatsoever. You're right of course, I used imprecise language that everyone understands, and you're choosing to read critically in order to be combative. You don't have to be so combative.

I initially glossed over this believing it may be something trivial, but it really is a deeper XSS concern. It feels weird me to dismiss as wontfix a security issue that gives the archived page far greater access to browser data than it has loaded at its original URL. > Last updated at Tue, 16 Jan 2024 16:26:37 GMT > tldr: For now, don't open .webarchive files, and check the Metasploit module, Apple Safari .webarchive File Format UXSS > Safari's webarchive format saves all the resources in a web page - images, scripts, stylesheets - into a single file. A flaw exists in the security model behind webarchives that allows us to execute script in the context of any domain (a Universal Cross-site Scripting bug). In order to exploit this vulnerability, an attacker must somehow deliver the webarchive file to the victim and have the victim manually open it ^1 (e.g. through email or a forced download), after ignoring a potential "this content was downloaded from a webpage" warning message ^2. Just look at the number of (relatively trivial) attack vectors identified by the author in this post: > Attack Vector #1: Steal the user's cookies. > Attack Vector #2: Steal CSRF tokens. > Attack Vector #3: Steal local files. > Attack Vector #4: Steal saved form passwords. > Attack Vector #5: Store poisoned javascript in the user's cache. https://www.rapid7.com/blog/post/2013/04/25/abusing-safaris-webarchive…

Rapid7's article on the topic[1] mostly focuses on the need for providing enough information to IT admins so they can understand the severity of the problem. There are other unsaid reasons for this (credit/payment I'd imagine is part of it), but on face value doesn't this make sense? When Metabase[2] says "Upgrade your instance NOW" and they have a vuln that "allows unprivileged access to any Metabase instance" I upgraded immediately. When JetBrains[3] says "4 security problems have been fixed. We highly recommend installing this update as it includes a fix for a critical security vulnerability" then many people are not going to upgrade as quickly. Jetbrains eventually gave more information[4] but would they have done this if Rapid7 wasn't threatening to disclose it themselves? ^1: https://www.rapid7.com/blog/post/2022/06/06/the-hidden-harm-of-silent-… ^2: https://discourse.metabase.com/t/upgrade-your-metabase-instance-now/26… ^3: https://www.jetbrains.com/help/teamcity/teamcity-2023-11-4-release-not… ^4: https://blog.jetbrains.com/teamcity/2024/03/additional-critical-securi…

Rapid7 | Remote | Senior Devops Engineer Rapid7 is probably most well known for Metasploit but also develops various SaaS security software. All of our SaaS systems are hosted within AWS and we are adding to our teams and focused on improving the architecture of our software to be more effective and resilient. This is a team which focuses on complex problems across many technologies to make them more efficient, secure and reliable. You will be working across different product teams and collaborating both with engineering teams, finance and leadership to introduce changes and provide visibility. You should have a great understanding of AWS, excellent troubleshooting skills and a thirst for knowledge. - Senior Devops Engineer - https://www.rapid7.com/careers/jobs/detail/?jid=R3101 - Site Reliability Engineer - https://www.rapid7.com/careers/jobs/detail/?jid=R3404 - Lead DevOps Engineer https://www.rapid7.com/careers/jobs/detail/?jid=R3832

Rapid7 | Senior Software Engineer | REMOTE or Arlington, VA | Full time The Rapid7 Labs team uses our experience, expertise, and passion for cyber security to establish a leading understanding of worldwide emerging attacker methodologies. In this senior role, you will cover multiple disciplines. This includes Data Engineering to enable and enhance our petabyte-scale internet scaling platform (Project Sonar) and our global honeypot network (Project Heisenberg) which drive research, enhance products, and empower the community. This role requires being a seasoned Software Engineer too as we build out proof of concept projects that may later become Rapid7 products. As a strong software engineer, you have experience in writing maintainable code that is properly instrumented and tested. You should love being always on the lookout for better solutions and keeping technical debt at bay. Tech stack: Python, Django REST Framework, AWS, Glue, Athena, Kafka, KSQLDB, PostgreSQL, Apache Airflow, Kubernetes About the team: Remote, agile/sprint, test-driven development, write clean code Learn more about our Research team here: https://www.rapid7.com/research/ Apply via LinkedIn here: https://r-7.co/3lICm9E

Yes. This is a very old article I had written back in the iOS 9 days, it still mostly applies. A few warnings: 1 - Changing an iOS device to "Supervised" will wipe it (so you can't supervise someone else's device and data). 2 - Backing up iOS devices over USB after requires that you keep the keypair, and makes restoring to new devices much more complicated. I would not recommend relying on USB backups if using this method unless you play around and understand it well. 3 - Be sure you set the profile to be removable only by wiping the device, or using Device Configurator, otherwise, the profile could be deleted to enable USB. 4 - One could wipe the keys completely to be sure that NO machine has USB access to the phone, meaning it would need to be restored to factory defaults for USB to work again. https://blog.rapid7.com/2015/11/26/reduced-annoyances-and-increased-se…

OP post has an indicators of compromise list, also seen in https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus… I'm surprised this wasn't linked from the original notepad++ disclosure

Other source: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus…

That's assuming the text is not corrupted or maliciously modified. There were (are) _numerous_ vulnerabilities due to parsing/escaping of invalid UTF-8 sequences. Quick googling (not all of them are on-topic tho): https://www.rapid7.com/blog/post/2025/02/13/cve-2025-1094-postgresql-p… https://www.cve.org/CVERecord/SearchResults?query=utf-8

The recent postgresql sql injection bug was similar. It happened because nobody was checking if a UTF8 string was valid. Postgres’s protections against sql injection assumed that whatever software passed it a query string had already checked that the string was valid UTF8 - but in some languages, this check was never being performed. This sort of bug is still possible in rust. (Although this particular bug is probably impossible - since safe rust checks UTF8 string validity at the point of creation). This is one article about it - there was a better write up somewhere but I can’t find it now: https://www.rapid7.com/blog/post/2025/02/13/cve-2025-1094-postgresql-p… Rust’s static memory protection does still protect you against most RCE bugs. Most is not all. But that’s still a massive reduction in security vulnerabilities compared to C or C++.

A little more context at https://www.rapid7.com/blog/post/2025/02/13/cve-2025-1094-postgresql-p… really does imply somebody is programmatically generating a SQL statement and then passing it to psql in a subprocess.

A big question with IPMI is what the default keys are. If someone manages to install some extra IPMI keys somewhere in the supply chain, or there's a default key, they can remote admin the computer.[1] [1] https://www.rapid7.com/blog/post/2013/07/02/a-penetration-testers-guid…

> Confirmation that if you're going to use an inexpensive router Expensive is no panacea, remember eg?: https://www.rapid7.com/blog/post/2023/10/17/etr-cve-2023-20198-active-…

I don't think that's fair, Google is a monopoly with anticompetitive practices. Why is it a shocker that they would forbid AGPL? They want to have their fiefdoms while charging exorbitant rents. They can't compete fairly. Also there are plenty of profitable software with AGPL licenses, some even get acquired by public companies [1]. [1] https://www.rapid7.com/about/press-releases/rapid7-acquires-digital-fo…

Not recent but the cybersecurity company Rapid7 uses a Java implementation called JESS (Java Expert System Shell) within their vulnerability management product to help determine vulnerable / unpatched state of scanned assets. https://www.rapid7.com/blog/post/2013/11/01/vulnerability-management-a…

Yes, I agree, but Rapid7 does not normally do that. https://www.rapid7.com/security/disclosure/ “ If the responsible organization is showing consistent good-faith effort to develop and ship an update, but cannot complete this work within 60 days, a 30-day extension may be granted at Rapid7’s sole discretion under the Default Policy (or for any of the enumerated exceptions below).” They do this with good faith as far as I have seen. The issue as I see it is that JetBrains decided to stop communicating, eliminating the “good faith” on their end.

Indeed. Also I wonder if Gitlab is still using this. Gitlab self-hosted users who didn't patch got bitten with in the wild exploitation: https://www.rapid7.com/blog/post/2021/11/01/gitlab-unauthenticated-rem…

Yes, it was covered everywhere all at once, after the event. The ex-filtration happened on May 27th and May 29th, and the vendor issued the alert on May 31st, after the wide-spread hacking. The Maine incident is not a new one, it too was from Memorial Day weekend hacks. https://www.rapid7.com/blog/post/2023/06/14/etr-cve-2023-34362-moveit-…

That’s a deep rabbit hole with a lot of naive people’s comments about capabilities from 15+ years ago. Here’s another one with recent updates from the chief architect of metasploit. https://www.rapid7.com/blog/post/2013/07/02/a-penetration-testers-guid…

A few years back, I recall reading about some automotive manufacturers who had just copied an example "airbag arming authorization" code/value that appeared in a shared spec document (IIRC) for their vehicles. There was a Metasploit module created (for the Hardware Bridge) that would send CAN bus messages to just check/verify if a particular vehicle uses this insecure arming code. For vehicles using this known code, an attacker with CAN bus access could deploy airbags on an unsuspecting target during vehicle operation. https://www.rapid7.com/blog/post/2017/12/22/metasploit-wrapup-21#nowav…

You're totally right, this is not the module I am thinking of. We used to do this exact step (yank all admins pubkeys from somewhere, and test logins with it to make an access map) in our pentests but now I am having trouble remembering what we used. Even better that there is a standalone tool then :) Edit: here is the right module: `auxiliary/scanner/ssh/ssh_identify_pubkeys`, it is sort of nice in that you can give it a range of usernames, pubkeys, and hosts and it will try all combinations, and can be routed through your meterpreter pivots: https://www.rapid7.com/db/modules/auxiliary/scanner/ssh/ssh_identify_p…

This seems like a fairly glaring oversight that really shouldn’t have happened. Between this and https://www.rapid7.com/blog/post/2021/09/15/omigod-how-to-automaticall… I’m starting to lose faith in the security of Azure.