How a vulnerability hack may happen and how to prevent it

on YouTube ↗19m

" summary

Shows a live remote code execution against a Java REST server by sending a crafted JSON payload that triggers Jackson databind vulnerabilities (example CVE CVE-2017-7525) and earlier exploits of Apache Struts 2 using an OGNL header, the same class of flaw that hit Equifax (~150 million records) and many organisations. Notes there are ~100 new OSS vulnerabilities per day in 2024 and demonstrates fixes via Finos code scanning and a git proxy/plugin workflow.

AI-written summary · about

" chapters (14)

1. 0:00Vulnerability hacks overview
2. 1:11Past hacks review
3. 2:18Canada Revenue Agency case
4. 3:19Equifax breach impact
5. 4:01Apache Struts 2 exploits
6. 5:46Why external components used
7. 7:52Vulnerability definition
8. 9:15Patching open source challenges
9. 9:57Live exploit demo
10. 12:48Preventing vulnerabilities
11. 13:31Finos scanning tools
12. 14:35IDE plugin for detection
13. 15:17IDE plugin demo
14. 17:25Conclusion

" related talks

• 56mThe Anatomy of Java VulnerabilitiesSteve Poole · Voxxed Days Cluj-Napoca 2018
• 46mLive hacking: Breaking into your Java web appBrian Vermeer · Devoxx Belgium 2019
• 35mInside a hacker’s mindMaria Shoaib · Øredev 2019
• 01h 06mLive hacking: Breaking into your Java web appBrian Vermeer · Global Summit for Java Devs 2020
• 49mThe Anatomy of Java VulnerabilitiesSteve Poole · Devoxx Belgium 2017
• 40mLive hacking: Breaking into your web appBrian Vermeer · Codemotion Berlin 2019
• 46mThe Anatomy of Java VulnerabilitiesSteve Poole · Oracle OpenWorld 2017
• 43mLive hacking: Breaking into your Java web appBrian Vermeer · Conf42 Enterprise Software 2021