Serial Killer Silently Pwning Your Java Endpoints

More documents

Recommendations

Info

Apply What You Have Learned Today Next week you should: Iden@fy your cri@cal applica@ons’ exposure to untrusted data that gets deserialised SAST might help here if codebase is big For already reported vulnerable products, ensure to apply patches Configure applica@ons with whitelists where possible In the first three months following this presenta@on you should: If possible switch the deserializa@on to other formats (JSON, etc.), or Use defensive deserializa@on with a strict whitelist Within six months you should: Use DAST to ac@vely scan for deserializa@on vulnerabili@es as part of your process Apply SAST techniques to search for aEacker-helping gadgets Extend this analysis also to non-cri@cal applica@ons 40
Chris;an Schneider @cschneider4711 mail@Chris@an-Schneider.net Q & A / Thank You ! Alvaro Muñoz @pwntester alvaro.munoz@hpe.com
Page 1 and 2: Chris;an Schneider Serial Killer: S
Page 3 and 4: Standing on the Shoulder of Giants
Page 5 and 6: AWack Surface Usages of Java serial
Page 7 and 8: Triggering Execu;on via "Magic Meth
Page 9 and 10: Exploi;ng "Magic Methods" But what
Page 11 and 12: Exploi;ng Invoca;onHandler (IH) Gad
Page 13 and 14: New RCE Gadget in BeanShell (CVE-20
Page 15 and 16: New RCE Gadget in Jython (CVE pendi
Page 17 and 18: Exis;ng Mi;ga;on Advice Simply remo
Page 19 and 20: Exis;ng Mi;ga;on Advice Simply remo
Page 21 and 22: How did vendors handle this recentl
Page 23 and 24: Is this for real or is this just fa
Page 25 and 26: Now with home delivery javax.media.
Page 27 and 28: Is it just Java Serializa;on? XStre
Page 29 and 30: XStream, can you run readObject()?
Page 31 and 32: Who Should Check for What? 1. Check
Page 33 and 34: High-Level Gadget Categories Gadget
Page 35 and 36: What to Check During Pentests? DAST
Page 37 and 38: Ac;ve Vulnerability Scanning Some B
Page 39: How to Harden Your Applica;ons? DO

Serial Killer Silently Pwning Your Java Endpoints

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?