~/talk

DataBinding2Shell: Novel Pathways to RCE Web Frameworks

on YouTube 37m
Talkat Black Hat Europe 2022 · 2022-12-05..12-08· [security, web-platform]

speakers

name:Biao He
links:none on file
name:Haowen Mu
links:none on file

resources

video:https://youtu.be/9BIAuwo4xvU
slides:none on file

summary

Researchers analyze data binding across Spring, Struts, Grails, Rails and others, report many bugs and 2 lead to remote code execution. They reverse-engineer Spring’s DataBinder and show a Java 9 module getModule bypass of a decade-old blacklist, plus classloader manipulation to load remote classes, Tomcat/GlassFish log-to-JSP tricks to write and execute payloads, and Groovy UCP/charset remote class loading. Defenses they test: prefer whitelists over blacklists, avoid dangerous dynamic language features and lock down resource/classloader access.

AI-written summary · about

chapters (12)

  1. 0:00Introduction
  2. 0:29Data Binding Overview
  3. 2:20Security Risks
  4. 4:44Spring Binding Mechanisms
  5. 7:33Spring Property Analysis
  6. 11:40Exploiting Spring Framework
  7. 15:16Framework Comparisons
  8. 18:24Language Feature Exploits
  9. 22:55Type Conversion Issues
  10. 25:55Tomcat & Classloader Attacks
  11. 30:43Remote Class Loading
  12. 34:09Defense and Conclusions

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.