The Perl Jam 2: The Camel Strikes Back
summary
Shows concrete exploits: a 5-line CGI example turns into RCE via piped open because CGI input can become arrays or hashes and bracketed file reads treat ARGV as paths; Bugzilla’s load_from_db takes a hash as “safe” and is exploitable via JSON RPC injection to perform SQLi. Demo uses CGI.pm, Mojolicious and Catalyst behaviors to create non-scalar inputs, a vulnerability present for over five years that successfully compromises databases and executes commands.
AI-written summary · about
chapters (7)
- 0:00Introduction to Perl flaws
- 2:01Community response to criticism
- 4:01Dangerous variable handling
- 8:09Exploiting the Billa application
- 11:59CGI modules and input issues
- 17:11Remote code execution demo
- 24:59Community denial and conclusion
related talks
35mPHP is evil (Defensive programming)
42mModern web application bugs
50mA New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!
42mHack Me If You Can
40mHow hacking works; Web edition
01h 01mHow hacking works - Web edition
46mLive hacking: Breaking into your Java web app
59mDon't Get Burned! Secure Coding Essentials to Protect Your Application