CVE-2018-7296: Directory Traversal / Arbitrary File Read in HomeMatic CCU2

Background HomeMatic is a home automation system consisting of various components for automating several parts of a building, including different sensors and actuators. The HomeMatic CCU2 is a central control unit, which is responsible for integrating these components with each other. From the vendor’s website (eQ-3): “The Homematic Central Control...


CVE-2018-7301: Unauthenticated XML-RPC Service in HomeMatic CCU2

Background HomeMatic is a home automation system consisting of various components for automating several parts of a building, including different sensors and actuators. The HomeMatic CCU2 is a central control unit, which is responsible for integrating these components with each other. From the vendor’s website (eQ-3): “The Homematic Central Control...


Docker Security Tool: InSpec CIS Docker Benchmark

We have recently published the new InSpec CIS Docker Benchmark profile. This InSpec compliance profile implements the CIS Docker 1.11.0 Benchmark in an automated way to provide security best-practice tests around the Docker daemon and containers in a production environment. Having the CIS document is very important, but to have...


Create a NAXSI WAF for Owncloud

Introduction A secure architecture of a web application consists of 3 components: a frontend, an application and a data backend. The frontend server’s task from a security perspective is to terminate SSL and to be the first line of defense. That means it inspects and validates requests from the untrusted...