Seokchan Yoon

Seokchan Yoon

Hi guys! I'm Seokchan Yoon (Channy), a security researcher working at Seoul, Korea.

Potential XSS bug found in Django Rest Framework

Potential XSS bug found in Django Rest Framework

안녕하세요 웹 해킹을 하고 있는 윤석찬입니다. 오랜만에 인사드립니다. 이번에는 한국 분들에게도 제 블로그를 노출시키고자, 한국어로 글을 쓰게 되었습니다. 최근 Django Rest Framework 소스코드를 살펴보다가, 부주의하게 사용했을 경우 XSS 공격으로부터 취약할 수 있는 기능을 발견해서 블로그에 정리해봅니다. 이미 Django Security 팀에는 report를 되어 인지된 이슈이기 때문에 블로그에 게시해도 되겠다 싶었고, 무엇보다

Review for Recent Django Security Issues － CVE-2024-24680, CVE-2024-27351

Review for Recent Django Security Issues － CVE-2024-24680, CVE-2024-27351

CVE-2024-24680: Potential denial-of-service in intcomma template filter TL;DR The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings. Your Django server can be under affected denial-of-service issue if you have the code like below, that intcomma template filter uses the value user

Bypassing DOMPurify for Successful XSS Execution: namespace confusion

Bypassing DOMPurify for Successful XSS Execution: namespace confusion

Introduce In the past, I often recommended the DOMPurify library as a robust solution for preventing XSS vulnerabilities, particularly when a web service needs to render HTML code input by users. Its effectiveness was such that I believed bypassing it to execute an XSS attack was virtually impossible, especially when

Do not use `maildev` anyway 💣

Do not use `maildev` anyway 💣

Introduce Do you guys know maildev application to run temporary mail server? maildev is open-sourced SMTP Server + Web Interface for viewing and testing emails during development. To say conclusionally, DO NOT USE THIS SOFTWARE. Hackers can force-write existing source codes and completely takeover the server. This program has not been

XSS Exception Bypass using Hoisting 🧙‍♂️

XSS Exception Bypass using Hoisting 🧙‍♂️

Recently, I stumbled upon some intriguing XSS tricks on Twitter and couldn't resist sharing my solutions. Let's dive into a fascinating XSS challenge and explore how we can outsmart it with JavaScript's hoisting mechanism. Somebody asked me recently if you can exploit an XSS scenario like this: x.y(1,

CVE-2023-36053: Potential ReDoS in EmailValidator/URLValidator

CVE-2023-36053: Potential ReDoS in EmailValidator/URLValidator

Hi! This is Seokchan Yoon studying Offensive Security in Korea. 🇰🇷 __ 1. Introduction On July 3rd, 2023, my first CVE was published! * https://www.djangoproject.com/weblog/2023/jul/03/security-releases/ * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36053 You can briefly check the details of the vulnerability that I

Scanning ReDoS in Python Automatically

Scanning ReDoS in Python Automatically

Hi, this is Seokchan Yoon. I'm currently taking a compiler course at KyungHee University this semester. Despite the short duration, I've had the pleasure of delving into intriguing topics, ranging from Lexing and Parsing algorithms to Abstract Syntax Trees (AST), Intermediate Representations (IR), and basic compiler optimization techniques. It has