Conference - Alvaro Muñoz, Alexandr Mirosh - Friday the 13th JSON attacks
Remote code execution vulnerabilities in JSON parsers across .NET and Java libraries.
Summary
Java Deserialization Crisis
2016 was the year of Java deserialization apocalypse. Apache Commons Collection RCE gadget brought attention to forgotten vulnerabilities, motivating security fixes across the community.
JSON Migration
A suggested solution was migrating from Java Deserialization to safer JSON formats. Popular JSON parsers in .NET and Java are analyzed for RCE vectors.
Vulnerable Libraries
RCE is possible in these libraries, with analysis showing default vulnerable configurations. Discussion covers common configurations enabling additional library vulnerabilities.
Beyond Deserialization
JSON parsers, considered safer alternatives, still exhibit serious vulnerabilities. Understanding JSON parsing security is critical for moving beyond deserialization while maintaining security.
Related talks
Main Stage·35 min
Jonathan Birch
Jonathan Birch demonstrates novel .NET deserialization RCE attacks that bypass standard assumptions, exploiting database drivers and immutable data streams.
Main Stage·40 min
Hao Xing · Zekai Wu
Hao Xing and Zekai Wu disclose a universal zero-day deserialization bypass in Fastjson, exploiting Java web services to execute RCE and drain crypto nodes.
Main Stage·43 min
Yuhao Weng · Steven Seeley · Zhiniang Peng
Star-V Lab researchers take a deep dive into Microsoft SharePoint Server, chaining multiple zero-day vulnerabilities to achieve unauthenticated remote code execution.