The Curious Case Of The Rogue SOAR
summary
Finds a command‑injection in Shuffler where the Liquid templating engine substitutes unescaped webhook inputs into a shell executed as root inside isolated Docker workflows. Exploit sends a crafted webhook (demo uses a Discord webhook + curl), gets a reverse shell via netcat forwarded over ngrok/nzero, and gains full internal access because SOAR tools are typically whitelisted. Raises concrete risks: log poisoning to trigger workflows and future LLM prompt‑injection attacks when SOARs use chat models.
AI-written summary · about
chapters (8)
- 0:00Speaker and Talk Introduction
- 1:23Act 0: It Starts With A Pivot
- 2:35Act 1: But what is a SOAR?
- 4:41Act 2: A thought experiment
- 5:48Act 3: Then there was a vulnerability
- 22:32Act 4: Insights
- 26:42Act 5: LLMS have entered the chat
- 30:23Conclusion
related talks
30mSOARing with Security Onion
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk
30mHow to hack an Angular app?
41mLive Hacking: Breaking into Your Web App
01h 00mThe Hand That Feeds: How to Misuse Kubernetes
30mTales of Red Teaming
51mStranger Danger: Your Node.js Attack Surface Just Got Bigger
47mToolShell, Patch Bypass, and the AI That Might Have Seen It Coming