SANS Stormcast Friday, March 28th: Sitecore Exploited; Blasting Past Webp; Splunk and Firefox Vulnerabilities

Sitecore "thumbnailsaccesstoken" Deserialization Scans (and some new reports) CVE-2025-27218

Our honeypots detected a deserialization attack against the CMS Sitecore using a thumnailaccesstoken header. The underlying vulnerability was patched in January, and security firm Searchlight Cyber revealed details about this vulnerability a couple of weeks ago.

https://isc.sans.edu/diary/Sitecore%20%22thumbnailsaccesstoken%22%20Deserialization%20Scans%20%28and%20some%20new%20reports%29%20CVE-2025-27218/31806

Blasting Past Webp

Google s Project Zero revealed details how the NSO BLASTPASS exploit took advantage of a Webp image parsing vulnerability in iOS. This zero-click attack was employed in targeted attack back in 2023 and Apple patched the underlying vulnerability in September 2023. But this is the first byte by byte description showing how the attack worked.

https://googleprojectzero.blogspot.com/2025/03/blasting-past-webp.html

Splunk Vulnerabilities

Splunk patched about a dozen of vulnerabilities. None of them are rated critical, but a vulnerability rated High allows authenticated users to execute arbitrary code.

https://advisory.splunk.com/

Firefox 0-day Patched

Mozilla patched a sandbox escape vulnerability that is already being exploited.

https://www.mozilla.org/en-US/security/advisories/mfsa2025-19/