Rotten Code, Aging Standards, & Pwning IPv4 Parsing
Kelly Kaoudis and Sick Codes disclose systemic IPv4 address parsing flaws across major programming languages (Python, Go, Rust), enabling SSRF and access bypasses.
Summary
Decades of Inconsistent IPv4 Address Parsing Standards
Although IPv4 is the bedrock of internet communications, modern programming language libraries interpret non-standard IP formats (such as leading zeros and octal notation) inconsistently.
Discovering Discrepancies Across Language Runtimes
Kelly Kaoudis and Sick Codes uncover that Python's `ipaddress`, Go's `net`, and Rust parsers handle octal and hex notation differently from underlying operating system socket APIs.
Weaponizing Parsing Discrepancies for SSRF and ACL Bypasses
By supplying IP strings with leading zeros (e.g. `0127.0.0.1`), attackers bypass allowlists and firewall rules to target internal cloud metadata endpoints.
Coordinated Industry-Wide Upstream Patching
The authors detail the massive coordinated patch release across Python, Rust, Go, Node.js, and core operating system networking libraries.
Related talks
Main Stage·44 min
Richard Henderson
Richard Henderson encodes the classic EICAR antivirus test string into QR codes and physical barcodes, triggering unexpected security alarms and system crashes across scanning hardware.
Main Stage·20 min
Joshua Maddux
Joshua Maddux weaponizes TLS protocol features—including session resumption and SNI parsing—to execute advanced Server-Side Request Forgery (SSRF) attacks.
Main Stage·28 min
Joshua Maddux
Joshua Maddux answers questions on weaponizing TLS protocol features for SSRF, session resumption exploitation, and mitigation.