Crossing the KASM: A Web Application Pentest Story
Samuel Erb and Justin Gardner share the story of finding and exploiting a complex RCE exploit chain against KASM Workspaces streaming software.
Summary
Auditing Containerized Virtual Workspaces
KASM Workspaces provides enterprise streaming of isolated virtual desktop containers to deliver browser-based workspaces to corporate users.
Deconstructing KASM Web Management Architecture
Samuel Erb and Justin Gardner analyze the multi-tiered architecture of KASM, identifying subtle flaws in session token handling and websocket routing.
Chaining Web Vulnerabilities to Container Compromise
The speakers walk through an ingenious exploit chain combining parameter injection, token manipulation, and API bypasses to achieve remote code execution.
Coordinated Disclosure and Hardening Lessons
The authors discuss working with KASM developers to patch the vulnerability and share takeaways for auditing container streaming platforms.
Related talks
Main Stage·36 min
Jeffrey Hofmann
Jeffrey Hofmann details discovering multiple pre-authentication remote code execution chains in Quest KACE Systems Management Appliance (SMA).
Main Stage·45 min
Aaditya Purani · Max Garrett
Aaditya Purani and Max Garrett expose systemic Electron framework misconfigurations, turning standard web XSS into remote code execution across popular desktop apps.
Main Stage·34 min
Eugene Lim
Eugene Lim (spac3sc) explores vulnerabilities in the ubiquitous iCalendar (.ics) standard, demonstrating zero-click XSS, RCE, and credential theft via calendar invites.