AI-powered
podcast player
Listen to all your favourite podcasts with AI-powered features
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS Stormcast Friday, March 28th: Sitecore Exploited; Blasting Past Webp; Splunk and Firefox Vulnerabilities
Mar 28, 2025
A recent deserialization attack targeted Sitecore, exploiting a thumbnail access token header. Google’s Project Zero detailed a zero-click NSO BlastPass exploit in iOS using a WebP vulnerability. Splunk patched several vulnerabilities, including one that allowed code execution for authenticated users. Meanwhile, Mozilla patched an active sandbox escape vulnerability in Firefox. The podcast highlights these critical security issues while urging listeners to stay informed on evolving cyber threats.
06:15
AI Summary
AI Chapters
Episode notes
Podcast summary created with Snipd AI
Quick takeaways
- A deserialization vulnerability in Sitecore's thumbnail access token header presents significant threats to users, emphasizing the need for better data collection on attack vectors.
- The analysis of the BlastPass exploit highlights critical memory management issues within compressed formats, underscoring the importance of secure coding practices for developers.
Deep dives
Exploiting HTTP Headers and Sitecore Vulnerability
The discussion revolves around a vulnerability in Sitecore, a content management system, related to a specific HTTP header known as the thumbnail access token. This header utilizes a .NET object, which when processed, has shown to have deserialization vulnerabilities. A recent examination revealed that requests containing this header closely matched a proof of concept exploit initially reported by Searchlight Cyber, highlighting the potential threat to users. Moving forward, there will be efforts to collect more comprehensive header data to better understand the attack vectors and potential risks associated with this vulnerability.
Get the Snipd
podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered
Discover
highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any
moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share
& Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered
podcast player
Listen to all your favourite podcasts with AI-powered features
Discover
highlights
Listen to the best highlights from the podcasts you love and dive into the full episode