Serial Killer Silently Pwning Your Java Endpoints

More documents

Recommendations

Info

Hardening Advice
How to Harden <strong>Your</strong> Applica;ons? DO NOT DESERIALIZE UNTRUSTED DATA!! When architecture permits it: Use other formats instead of serialized objects: JSON, XML, etc. But be aware of XML-based deserializa@on aEacks via XStream, XmlDecoder, etc. As second-best op@on: Use defensive deserializa@on with look-ahead OIS with a strict whitelist Don’t rely on gadget-blacklis@ng alone! You can build the whitelist with OpenSource agent SWAT (<strong>Serial</strong> Whitelist Applica@on Trainer) Prefer an agent-based instrumen@ng of ObjectInputStream towards LAOIS Scan your own whitelisted code for poten@al gadgets S@ll be aware of DoS scenarios If possible use a SecurityManager as defense-in-depth 39
Page 1 and 2: Chris;an Schneider Serial Killer: S
Page 3 and 4: Standing on the Shoulder of Giants
Page 5 and 6: AWack Surface Usages of Java serial
Page 7 and 8: Triggering Execu;on via "Magic Meth
Page 9 and 10: Exploi;ng "Magic Methods" But what
Page 11 and 12: Exploi;ng Invoca;onHandler (IH) Gad
Page 13 and 14: New RCE Gadget in BeanShell (CVE-20
Page 15 and 16: New RCE Gadget in Jython (CVE pendi
Page 17 and 18: Exis;ng Mi;ga;on Advice Simply remo
Page 19 and 20: Exis;ng Mi;ga;on Advice Simply remo
Page 21 and 22: How did vendors handle this recentl
Page 23 and 24: Is this for real or is this just fa
Page 25 and 26: Now with home delivery javax.media.
Page 27 and 28: Is it just Java Serializa;on? XStre
Page 29 and 30: XStream, can you run readObject()?
Page 31 and 32: Who Should Check for What? 1. Check
Page 33 and 34: High-Level Gadget Categories Gadget
Page 35 and 36: What to Check During Pentests? DAST
Page 37: Ac;ve Vulnerability Scanning Some B
Page 41: Chris;an Schneider @cschneider4711

Serial Killer Silently Pwning Your Java Endpoints

Create successful ePaper yourself

Delete template?

Save as template?