Lately, we came across a remote code execution in a Tomcat web service by
utilizing
Expression Language.
The vulnerable POST body field expected a number. When sending ${1+2} instead,
the web site included a Java error message about a failed conversion to
java.lang.Long from java.lang.String with value "3".
From that error message we learned a couple of things:
The application uses Java
We are able to execute EL expressions
Output from the EL engine is always returned as String
Whenever you are able to execute code within a Java Context, the most
interesting part is to check whether we can get a Runtime object and execute
arbitrary OS commands.
I have the pleasure to announce the Active Directory Security Summit 2018 at
13^(th). of November of 2018. The summit covers current Active Directory
security related topics such as challenging tasks of hybrid Active Directory
operations as well as new security best practices and some ‘evergreens’ – Admin
Tiering implementations (what about Exchange and DNS…??), ESAE operations etc.
😉
The primary objective of the Active Directory Security Summit is to bring
experts together:
Some readers will probably be aware that we are amongst the proponents of a
quite strict stance when it comes to filtering IPv6 packets with (certain)
Extension Headers and/or fragmentation, because those can be the source of many
security problems (as laid out
here,
here
or
here).
Actually I still think it was a very good idea of, amongst others, Randy Bush
and Ron Bonica to
suggest the deprecation of IPv6 fragmentation in the IETF.
On
the other hand there are voices arguing that fragmented IPv6 packets will be
needed in some cases, namely DNS[SEC]-related ones.
In this post I will discuss some details of this debate (taking place in many
circles, incl.
this thread
on the ipv6-hackers mailing list which, btw,
you should subscribe to).