Far Sides of Java Remote Protocols
summary
Research finds 100% of products tested expose at least one exploitable flaw in Java RMI/CORBA stacks; concrete attacks include sending crafted RMI headers then appending a gadget payload (tested with a Python header+payload script), abusing JNDI/LDAP gadget chains for remote class loading, proxying return values to exfiltrate data, and using registry rebind to hijack services (demonstrated on Tomcat and IBM stacks) to achieve remote code execution.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:38Java remote protocol
- 2:21Simple architecture
- 3:16Protocol analysis
- 6:06Past exploits
- 7:20JRE History
- 8:40Attacking RMI - Registry whitelist bypass
- 12:18Custom services
- 16:36JMX flow
- 20:23IBM Websphere Application Server
- 27:28Vendors are not prepared for this
- 28:21Attacking RMI 45 - (in)Security Manager
- 30:45Attacking RMI 46 - RMI Registry
- 34:52Exploit analysis
- 35:33Vulnerability pattern
- 40:48CORBA Naming Service
- 42:20Mitigations
- 43:07Exploit Development
related talks
48mA Journey From JNDI/LDAP Manipulation to Remote Code Execution Dream Land
56mThe Anatomy of Java Vulnerabilities
46mThe Anatomy of Java Vulnerabilities
49mThe Anatomy of Java Vulnerabilities
49mPwning Your Java Messaging With Deserialization Vulnerabilities
40mA New Attack Interface in Java Applications
23mMight As Well JUMP: Exploit Development For Java Serialization
50mStranger Danger: Your Java Attack Surface Just Got Bigger