Serial Killer Silently Pwning Your Java Endpoints
OWASPBNL_Java_Deserialization OWASPBNL_Java_Deserialization
Demo of bypass Let’s take a look at the live demo… 26
Is it just Java Serializa;on? XStream is like Java Serializa@on on steroids Can deserialize non-serializable classes: —> many more gadgets available Reported back in 2013: CVE-2013-7285 by Alvaro Munoz (@pwntester) & Abraham Kang (@KangAbraham) XStream implemented a blacklist/whitelist protec@on scheme (by default only blocking java.beans.EventHandler) Unfortunately devs are not fully aware and s@ll use unprotected or only blacklisted XStream instances e.g.: CVE-2015-5254 in Apache Ac;veMQ and CVE-2015-5344 in Apache Camel both by @pwntester, @cschneider4711, @maEhias_kaiser We found many new gadgets during research Can’t be fixed by making them non-serializable. Only fix is applying a whitelist to XStream instance. … plus most of the ones available for Java serializa@on (e.g.: Commons-Collec@ons, Spring, …) 27
- Page 1 and 2: Chris;an Schneider Serial Killer: S
- Page 3 and 4: Standing on the Shoulder of Giants
- Page 5 and 6: AWack Surface Usages of Java serial
- Page 7 and 8: Triggering Execu;on via "Magic Meth
- Page 9 and 10: Exploi;ng "Magic Methods" But what
- Page 11 and 12: Exploi;ng Invoca;onHandler (IH) Gad
- Page 13 and 14: New RCE Gadget in BeanShell (CVE-20
- Page 15 and 16: New RCE Gadget in Jython (CVE pendi
- Page 17 and 18: Exis;ng Mi;ga;on Advice Simply remo
- Page 19 and 20: Exis;ng Mi;ga;on Advice Simply remo
- Page 21 and 22: How did vendors handle this recentl
- Page 23 and 24: Is this for real or is this just fa
- Page 25: Now with home delivery javax.media.
- Page 29 and 30: XStream, can you run readObject()?
- Page 31 and 32: Who Should Check for What? 1. Check
- Page 33 and 34: High-Level Gadget Categories Gadget
- Page 35 and 36: What to Check During Pentests? DAST
- Page 37 and 38: Ac;ve Vulnerability Scanning Some B
- Page 39 and 40: How to Harden Your Applica;ons? DO
- Page 41: Chris;an Schneider @cschneider4711
Demo of bypass<br />
Let’s take a look at the live demo…<br />
26
Change language