Pwning Your Java Messaging With Deserialization Vulnerabilities
summary
Shows that JMS object messages deserialize untrusted data across many brokers, with about 13 vendors vulnerable including Oracle, IBM and RabbitMQ; Apache ActiveMQ patches early, several major products remain unpatched. Provides an exploitation path: send a serialized gadget (built with ysoserial via JMET (Java Message Exploitation Tool)) to a queue or topic and trigger remote code execution. Demonstrates a real exploit against HP Network Node Manager where a topic causes repeated deliveries and topic multicast multiplies impact (27 processes spawned). Advises whitelisting or disabling object messages and using JVM agents as mitigation.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:12Announcements
- 3:14Motivation behind this Research
- 4:59Disclaimers
- 12:57Message Brokers
- 19:19Create Connection
- 28:54Apache Cupid
- 31:22Exploitation Scenarios
- 34:04Chava Message Exploitation Tool
- 36:32Target System
- 42:09Conclusion
related talks
51mWassup MOM? Owning the Message Oriented Middleware
56mThe Anatomy of Java Vulnerabilities
45mFar Sides of Java Remote Protocols
40m[In]secure Deserialization, And How [Not] To Do It
35mHow To Find The Next Great Deserialization CVE
49mThe Anatomy of Java Vulnerabilities
47mA Modern Fairy Tale: Java Serialization
51mNew Exploit Technique In Java Deserialization Attack