NexurAI
Memory over-reads that leak keys, tokens and sessions - and bypass MFA.
Some flaws don't run code - they leak memory. This path covers over-reads that spill private keys, credentials and session tokens, and how attackers replay stolen sessions to walk past MFA. The critical lesson: patching alone doesn't evict already-stolen tokens.
A missing bounds check in the TLS heartbeat extension leaks up to 64KB of server memory per request - keys, sessions and secrets.
OpenSSL 1.0.1 - 1.0.1f (TLS heartbeat) · 2014
The attacker sends malformed heartbeat requests and reads back chunks of process memory, potentially harvesting private keys and credentials over many requests.
Alert on malformed TLS heartbeat records and abnormal heartbeat request volume; IDS signatures exist for the over-read.
Upgrade OpenSSL, then reissue/rotate certificates and revoke old keys, and force credential resets.
A buffer over-read leaks session tokens from NetScaler memory, letting attackers hijack authenticated sessions and bypass MFA.
Citrix NetScaler ADC / Gateway · 2023
The attacker sends a crafted request to over-read memory, harvests valid session cookies, and replays them to impersonate users without credentials or MFA.
Hunt for session reuse from new IPs/user-agents, impossible-travel logins, and large or malformed requests to the NetScaler; correlate with VPN session anomalies.
Patch NetScaler, then terminate ALL active sessions (patching alone does not evict stolen tokens), and review for post-exploitation activity.
A path traversal in the FortiOS SSL VPN portal leaks system files - including plaintext VPN credentials - to unauthenticated attackers.
Fortinet FortiOS SSL VPN · 2018
The attacker requests a crafted URL to read the sslvpn session file, harvesting usernames and passwords, then logs into the VPN as a real user.
Alert on requests to /remote/fgt_lang?lang=/../ or sslvpn_websession reads, and on VPN logins that follow from new IPs shortly after.
Patch FortiOS, then reset ALL VPN credentials (leaked creds persist after patching), and enforce MFA on the VPN.
A zero-click flaw: a crafted calendar/email reminder with a UNC path makes Outlook authenticate to the attacker, leaking Net-NTLMv2 - no user interaction.
Microsoft Outlook (reminder UNC path) · 2023
The attacker sends an appointment with PidLidReminderFileParameter pointing to a UNC path on their server; Outlook connects on reminder, leaking the NTLM hash to relay or crack.
Hunt for outbound SMB (445) to external/unknown hosts from user workstations, and use Microsoft's script to scan mailboxes for malicious reminder properties.
Patch Outlook, block outbound SMB to the internet, add users to Protected Users / enforce SMB signing, and run the mailbox-scanning script.
An unauthenticated arbitrary file read on Pulse Secure VPN leaks system files - including plaintext credentials and session data.
Pulse Connect Secure SSL VPN · 2019
The attacker requests a crafted path to read arbitrary files, harvesting cached credentials and session tokens, then logs in as legitimate users (bypassing MFA via stolen sessions).
Alert on path-traversal-style requests to the VPN, session reuse from new IPs, and impossible-travel logins; review VPN logs for anomalous access.
Patch, then reset ALL VPN credentials and terminate sessions (leaked creds/sessions persist after patching), and enforce MFA.
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.