Serial Killer Silently Pwning Your Java Endpoints

More documents

Recommendations

Info

Bypassing LookAhead Blacklists New gadget type to bypass ad-hoc look-ahead ObjectInputStream blacklist protec@ons: Can we find a class like: 1 public class NestedProblems implements <strong>Serial</strong>izable { 2 byte[] bytes … ; 3 … 4 private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException { 5 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(bytes)); 6 ois.readObject(); 7 } 8 } During deserializa@on of the object graph, a new immaculate unprotected ObjectInputStream will be instan@ated AEacker can provide any arbitrary bytes for unsafe deserializa@on Bypass does not work for cases where ObjectInputStream is instrumented 22
Is this for real or is this just fantasy? Currently we found many bypass gadgets: JRE: 3 Third Party Libraries: Apache libraries: 6 Spring libraries: 1 Other popular libraries: 2 Applica@on Servers: IBM WebSphere: 13 Oracle WebLogic: 3 Apache TomEE: 3 … 23
Page 1 and 2: Chris;an Schneider Serial Killer: S
Page 3 and 4: Standing on the Shoulder of Giants
Page 5 and 6: AWack Surface Usages of Java serial
Page 7 and 8: Triggering Execu;on via "Magic Meth
Page 9 and 10: Exploi;ng "Magic Methods" But what
Page 11 and 12: Exploi;ng Invoca;onHandler (IH) Gad
Page 13 and 14: New RCE Gadget in BeanShell (CVE-20
Page 15 and 16: New RCE Gadget in Jython (CVE pendi
Page 17 and 18: Exis;ng Mi;ga;on Advice Simply remo
Page 19 and 20: Exis;ng Mi;ga;on Advice Simply remo
Page 21: How did vendors handle this recentl
Page 25 and 26: Now with home delivery javax.media.
Page 27 and 28: Is it just Java Serializa;on? XStre
Page 29 and 30: XStream, can you run readObject()?
Page 31 and 32: Who Should Check for What? 1. Check
Page 33 and 34: High-Level Gadget Categories Gadget
Page 35 and 36: What to Check During Pentests? DAST
Page 37 and 38: Ac;ve Vulnerability Scanning Some B
Page 39 and 40: How to Harden Your Applica;ons? DO
Page 41: Chris;an Schneider @cschneider4711

Serial Killer Silently Pwning Your Java Endpoints

Create successful ePaper yourself

Delete template?

Save as template?