A Journey From JNDI/LDAP Manipulation to Remote Code Execution Dream Land

on YouTube ↗48m

" summary

A new class of JNDI vulnerability claims remote code execution via CVE-2015-4902 by abusing dynamic protocol switching so lookups can be pointed at attacker servers. Exploits use RMI/LDAP/CORBA vectors, demo binds an RMI reference to an EclipseLink/TopLink RESTed endpoint and pops a calculator on the server. Spring Security’s LDAP integration (used by ~1,300 Maven artifacts) enables LDAP entry poisoning, attackers inject Java attributes and fetch remote factories. Analysis finds 20+ gadget classes in Oracle JDK, 50+ in OpenJDK, 200+ across app server libraries.

AI-written summary · about

" chapters (27)

1. 0:00Intro
2. 2:23JNDI in a Nutshell
3. 3:28JNDI Architecture
4. 4:18JNDI In Action
5. 5:15JNDI Naming References
6. 6:56JNDI Remote Class Loading
7. 9:08Attack Process
8. 9:36Dynamic Protocol Switching
9. 10:37JNDI Vectors
10. 12:15RMI Vector: JNDI Reference Payload
11. 12:54Previous Research: Click-to-play bypass
12. 14:12Previous Research: Deserialization attack
13. 20:12CORBA Vector: IOR
14. 20:53CORBA Vector: Limitations & Bypasses
15. 22:48CORBA Vector: IIOP Listeners
16. 23:57CORBA Vector: Deserialization Attacks
17. 25:22LDAP Vector
18. 26:43Lookup (Naming) vs Search (Directory)
19. 27:38Object-Returning Searches
20. 28:21Java Object Decoding
21. 29:22Java Schema (RFC 2713)
22. 29:54Entry Poisoning with Serialized Objects
23. 30:49Entry Poisoning with JNDI References
24. 33:19Attack Scenarios: Entry Manipulation
25. 34:18Attack Scenarios: MITM Tampering
26. 38:27Recommendations
27. 40:34BlackHat Sound Bytes

" related talks

• 51mNew Exploit Technique In Java Deserialization AttackYongtao Wang, Lucas Zhang, Kunzhe Chai · Black Hat Europe 2019
• 33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)Steve Poole · EclipseCon 2022
• 40mA New Attack Interface in Java ApplicationsPeter Mularien (PeterM), Xu Yuanzhen · Black Hat Asia 2023
• 48mThe Hidden Security Hazards in Your Java StackBrian Vermeer · Voxxed Days Zurich 2026
• 56mThe Anatomy of Java VulnerabilitiesSteve Poole · Voxxed Days Cluj-Napoca 2018
• 02h 38mJava application security the hard way - a workshop for the serious developerSteve Poole · Devoxx France 2022
• 48mCommon vulnerabilities you wish your Java app didn't have!Simon Maple · J-Fall 2018
• 45mFar Sides of Java Remote ProtocolsAn Trinh · Black Hat Europe 2019