Loading…
This event has ended. Create your own event → Check it out
This event has ended. Create your own
View analytic
Friday, September 22 • 11:30am - 12:15pm
Friday the 13th: Attacking JSON

Sign up or log in to save this to your schedule and see who's attending!

Feedback form is now closed.

2016 was the year of Java deserialization apocalypse. Although Java Deserialization attacks were known for years, the publication of the Apache Commons Collection Remote Code Execution (RCE from now on) gadget finally brought this forgotten vulnerability to the spotlight and motivated the community to start finding and fixing these issues.

One of the most suggested solutions for avoiding Java deserialization issues was to move away from Java Deserialization altogether and use safer formats such as JSON. In this talk, we will analyze the most popular JSON parsers in both .NET and Java for potential RCE vectors.

We will demonstrate that RCE is also possible in these libraries and present details about the ones that are vulnerable to RCE by default. We will also discuss common configurations that make other libraries vulnerable.

In addition to focusing on JSON format, we will generalize the attack techniques to other serialization formats. In particular, we will pay close attention to several serialization formats in .NET. These formats have also been known to be vulnerable since 2012 but the lack of known RCE gadgets led some software vendors to not take this issue seriously. We hope this talk will change this. With the intention of bringing the due attention to this vulnerability class in .NET, we will review the known vulnerable formats, present other formats which we found to be vulnerable as well and conclude presenting several gadgets from system libraries that may be used to achieve RCE in a stable way: no memory corruption -- just simple process invocation.

Finally, we will provide recommendations on how to determine if your code is vulnerable, provide remediation advice, and discuss alternative approaches.



Speakers
avatar for Oleksandr Mirosh

Oleksandr Mirosh

Security Research QA Engineer, HPE
Oleksandr Mirosh is working for HPE Software Security Research team investigating and analyzing new threats, vulnerabilities, security weaknesses, new techniques of exploiting security issues and development vulnerability detection, protection and remediation rules.
avatar for Alvaro Muñoz

Alvaro Muñoz

Principal Security Researcher, HPE
Alvaro Muñoz (@pwntester) works as Principal Software Security Researcher with HPE Security Research (HPSR). His research focuses on different programming languages and web application frameworks searching for vulnerabilities or unsafe uses of APIs. Before joining the HPSR team... Read More →


Friday September 22, 2017 11:30am - 12:15pm
Coronado L

Attendees (85)