Serial Killer Silently Pwning Your Java Endpoints

Recommendations

Info

Proxy with Invoca;onHandler as Catalyzer Proxy method2 Interface method1 method2 Class field1 field2 … method1 method2 Invocation Handler Custom code 10
Exploi;ng Invoca;onHandler (IH) Gadgets AEacker steps upon serializa@on: AEacker controls member fields of IH gadget, which has dangerous code IH (as part of Dynamic Proxy) gets serialized by aEacker as field on which an innocuous method is called from "magic method" (of class to deserialize) Applica@on steps upon deserializa@on: "Magic Method" of "Trigger Gadget" calls innocuous method on an aMacker controlled field This call is intercepted by proxy (set by aEacker as this field) and dispatched to IH Other IH-like types exist aside from java.lang.reflect.Invoca@onHandler javassist.u@l.proxy.MethodHandler org.jboss.weld.bean.proxy.MethodHandler 11
Page 1 and 2: SESSION ID: ASD-F03 Alvaro Muñoz S
Page 3 and 4: What is Java Serializa;on again? Ta
Page 5 and 6: Standing on the Shoulder of Giants
Page 7 and 8: Triggering Execu;on via "Magic Meth
Page 9: Exploi;ng "Magic Methods" But what
Page 13 and 14: New RCE Gadget in BeanShell (CVE-20
Page 15 and 16: New RCE Gadget in Jython (CVE pendi
Page 17 and 18: Demo of aMack Let’s take a look a
Page 19 and 20: Exis;ng Mi;ga;on Advice Simply remo
Page 21 and 22: Exis;ng Mi;ga;on Advice Simply remo
Page 23 and 24: Bypassing LookAhead Blacklists New
Page 25 and 26: Example (has been fixed) org.apache
Page 27 and 28: Demo of bypass Let’s take a look
Page 29 and 30: Exploi;ng JNA 1 2 calc.exe 3 4 ja
Page 31 and 32: #RSAC Finding Vulnerabili;es & Gadg
Page 33 and 34: Finding Direct Deserializa;on Endpo
Page 35 and 36: Finding Gadgets for Fun & Profit Si
Page 37 and 38: Passive Deserializa;on Endpoint Det
Page 39 and 40: Hardening Advice #RSAC
Page 41 and 42: Apply What You Have Learned Today N

Serial Killer Silently Pwning Your Java Endpoints

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?