A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

on YouTube ↗47m

" summary

A custom URL-parser fuzzer tests many languages (Python, PHP, Perl, Ruby, Java, JavaScript, Wget, cURL) against a local DNS/webserver/iptables setup and finds multiple 0days in standard libraries, including inconsistent host/port/path parsing, Unicode newline encoding and libC gethostbyname quirks. These allow URL parser fuzzing to produce SNI newline smuggling and CRLF-based protocol smuggling, chain into a memcached-stored Ruby object and achieve GitHub Enterprise RCE in a working demo that earned a bounty.

AI-written summary · about

" chapters (17)

1. 0:00Intro
2. 2:11Agenda
3. 2:58What is SSRF?
4. 3:52Protocol Smuggling in SSRF
5. 4:55Quick Fun Example
6. 10:02Fuzzer Architecture
7. 12:20URL Parsing issues
8. 13:23URL Components(RFC 3986)
9. 14:15Big Picture
10. 20:03NodeJS Unicode Failure
11. 23:00GLibc NSS Features
12. 30:09Abusing IDNA Standard
13. 32:07Abusing URL Parsers - Case Study
14. 36:09Protocol Smuggling - Case Study
15. 44:58Mitigations
16. 45:39Summary
17. 46:24Further works

" related talks

• 50mA New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!Orange Tsai, Cheng-Da Tsai · CODE BLUE 2017
• 01h 04mServer-Side Browsing Considered HarmfulNicolas Gregoire · OWASP AppSec Research (AppSecEU) 2015
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 26mExposing Hidden Exploitable Behaviors In Programming Languages Using Differential FuzzingFernando Arnaboldi · Black Hat Europe 2017
• 58mModern web application bugsErlend Oftedal · NDC Minnesota 2019
• 56mModern Web Vulnerabilities 2020Erlend Oftedal · NDC Security Oslo 2020
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019
• 35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · DevDays Europe 2019