Serial Killer Silently Pwning Your Java Endpoints

Recommendations

Info

Now with home delivery javax.media.jai.remote.SerializableRenderedImage finalize() > dispose() > closeClient() 1 private void closeClient() { 2 3 // Connect to the data server. 4 Socket socket = connectToServer(); 5 6 // Get the socket output stream and wrap an object 7 // output stream around it. 8 OutputStream out = null; 9 ObjectOutputStream objectOut = null; 10 ObjectInputStream objectIn = null; 11 try { 12 out = socket.getOutputStream(); 13 objectOut = new ObjectOutputStream(out); 14 objectIn = new ObjectInputStream(socket.getInputStream()); 15 } catch (IOException e) { ... } 16 ... 18 try { 19 objectIn.readObject(); 20 } catch (IOException e) { 21 sendExceptionToListener(JaiI18N.getString( 22 "SerializableRenderedImage8"), 23 new ImagingException(JaiI18N.getString( 24 "SerializableRenderedImage8"), e)); 25 } catch (ClassNotFoundException cnfe) { 26 sendExceptionToListener(JaiI18N.getString( 27 "SerializableRenderedImage9"), 28 new ImagingException(JaiI18N.getString( 29 "SerializableRenderedImage9"), cnfe)); 30 } 31 ... 32 } Bypasses ad-hoc Security Managers 26
Demo of bypass Let’s take a look at the live demo… 27
Page 1 and 2: SESSION ID: ASD-F03 Alvaro Muñoz S
Page 3 and 4: What is Java Serializa;on again? Ta
Page 5 and 6: Standing on the Shoulder of Giants
Page 7 and 8: Triggering Execu;on via "Magic Meth
Page 9 and 10: Exploi;ng "Magic Methods" But what
Page 11 and 12: Exploi;ng Invoca;onHandler (IH) Gad
Page 13 and 14: New RCE Gadget in BeanShell (CVE-20
Page 15 and 16: New RCE Gadget in Jython (CVE pendi
Page 17 and 18: Demo of aMack Let’s take a look a
Page 19 and 20: Exis;ng Mi;ga;on Advice Simply remo
Page 21 and 22: Exis;ng Mi;ga;on Advice Simply remo
Page 23 and 24: Bypassing LookAhead Blacklists New
Page 25: Example (has been fixed) org.apache
Page 29 and 30: Exploi;ng JNA 1 2 calc.exe 3 4 ja
Page 31 and 32: #RSAC Finding Vulnerabili;es & Gadg
Page 33 and 34: Finding Direct Deserializa;on Endpo
Page 35 and 36: Finding Gadgets for Fun & Profit Si
Page 37 and 38: Passive Deserializa;on Endpoint Det
Page 39 and 40: Hardening Advice #RSAC
Page 41 and 42: Apply What You Have Learned Today N

Serial Killer Silently Pwning Your Java Endpoints

Create successful ePaper yourself

Delete template?

Save as template?