The Hidden Security Hazards in Your Java Stack
summary
Shows concrete failures and fixes: Copilot produces a concatenated query that becomes SQL injection via Copilot-generated query; Burp Suite intercepts uploads to demonstrate path traversal with original filename that writes outside the upload folder; the SAX parser default allows XXE exfiltrating /etc/passwd; an Exploit-DB PoC uploads a JSP to an old Tomcat in Docker and gets root; Snyk scans report hundreds of Tomcat vulnerabilities and recommended fixes are update runtimes, use parameterized/named queries, and disable external entities.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:53Enterprise software insecurity
- 8:46AI code and SQL injection
- 16:51File upload vulnerabilities
- 21:52XXE in Java apps
- 26:00Log4j vulnerability
- 36:18Docker runtime flaws
- 41:44Infrastructure security gaps
- 42:45Shared security responsibility
- 47:00Q&A
related talks
48mThe Hidden Security Hazards in Your Java Stack
50mStranger Danger: Your Java Attack Surface Just Got Bigger
26mStranger Danger: Your Attack Surface Just Got Bigger
47mDon't Get Burned! Secure Coding Essentials to Protect Your Application
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application
43mTop Security Flaws Hiding in Your Code Right Now – and How to Fix Them
56mThe Anatomy of Java Vulnerabilities
52mDon't Get Burned! Secure Coding Essentials in Java to protect your application.