When a framework dies… A case study of CVE-2018-12533
summary
A case study of CVE-2018-12533 in the RichFaces Java web framework, showing how specially crafted EL expressions that include a serialized, base64-compressed object can force expression evaluation and enable remote code execution via an Apache Commons Collections gadget (demonstrated with Runtime.exec payloads against JBoss and Tomcat). The talk covers fingerprinting techniques (unique URL fragments, Shodan and custom scraping) used to find about 5,000 live vulnerable instances, automated harvesting and country-by-country triage, and the disclosure workflow with concrete examples of what remediation steps worked, which failed, and how long fixes took.
AI-written summary · about
chapters (9)
- 0:00Wprowadzenie i motywacja
- 5:49Czym jest Expression Language
- 10:05Mechanizm exploita w praktyce
- 14:21Przygotowanie środowiska demo
- 24:09Wyszukiwanie podatnych aplikacji
- 29:08Proces zgłaszania podatności
- 36:07Narzędzia i metody kontaktu
- 38:40Sprawdzanie własnych systemów
- 43:47Podsumowanie i wnioski
related talks
56mThe Anatomy of Java Vulnerabilities
46mLive hacking: Breaking into your Java web app
49mThe Anatomy of Java Vulnerabilities
50mStranger Danger: Your Java Attack Surface Just Got Bigger
01h 06mLive hacking: Breaking into your Java web app
46mThe Anatomy of Java Vulnerabilities
43mLive hacking: Breaking into your Java web app
19mHow a vulnerability hack may happen and how to prevent it