Friday the 13th: Attacking JSON
summary
Shows concrete RCE chains against Java and .NET JSON parsers by abusing type discriminators and setter calls, with working ObjectDataProvider gadget that spawns calc via Process.Start and a PSObject gadget that yields stable remote execution on Windows. Demonstrations exploit JSON.NET/Jackson and unsafe config in Breeze, Nancy and DotNetNuke, deploy a web shell on DotNetNuke and pop calculator in demos, and maps which libraries include type names by default versus those requiring explicit configuration.
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 2:19JSON deserialization basics
- 5:55DotNet gadget chains
- 11:10JSON library vulnerabilities
- 17:11Breeze framework demo
- 23:04DotNet framework attacks
- 28:41Nancy framework demo
- 30:48Generalizing attack techniques
- 37:49DotNetNuke exploitation demo
- 39:20Conclusion and takeaways
related talks
49mDeserialization vulns: past, present, and future
44mSecond Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET
24mSecond Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET
34mDeserialization: what, how and why [not]
23m{JS-ON: Security-OFF}: Abusing JSON-Based SQL Queries
42mModern web application bugs
51mMarshalling Pickles
29mHack Me if You Can