The Code Behind The Vulnerability

on YouTube ↗45m

" summary

Nine MSRC cases and one advisory get dissected with concrete reproductions and fixes: a hash collision DOS demo that inserts 1,000,000 keys and motivates process-randomized hash seeds, a padding oracle timing exploit that leaks web.config and machine keys, multiple binary formatter RCE incidents (SharePoint, Exchange, Docker) where deserialization deletes files or runs PowerShell, a regex backtracking DoS from a jQuery email pattern, a WSDL-in-Word codegen RCE, and Kestrel host‑header password reset phishing, all fixed by HMAC signatures, timeouts, input validation and avoiding BinaryFormatter.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 3:55Hash DOS (CVE-2011-3141) A Denial of Service caused by parsing FORM inputs. Caused by HashTable and Dictionary using a predictable hash algorithm for string keys. Fixed by switching hash functions to one that is unpredictable or limiting dictionary size
3. 8:10How can I fix this? Don't use user input as keys in dictionaries unless The user input is a string OR The HashCode for the input is strong and you implement a session key, eg. SHA1HMAC with a random key set at runtime.
4. 9:05Padding Oracle (CVE-2010-3332) Information disclosure via cryptographic attack An endpoint was exposed which validated if a string was encrypted correctly The attacker could use the yes or no result to build properly encrypted strings without knowing the key This then allowed forged requests to scriptrescurce.axd and serve up any file in the web application, like web.config, which contains machine keys, which you can forge auth tickets with. Fixed by having scriptresource.axd validate signatures and serve
5. 26:38Infinite Regex Demo
6. 31:22CSRF in ASP.NET Core (CVE-2018-0785) CSRF allows another site to act on behalf of a logged in user.
7. 34:31IsValidUrl() inside the parser had a bug. This enabled a nation state targeting Russian speakers in another Eastern Europe country to compile code on their machine.

" related talks

• 58mThe Code Behind The VulnerabilityBarry Dorrans · NDC Sydney 2017
• 01h 01mThe Code Behind The VulnerabilityBarry Dorrans · NDC Sydney 2018
• 43mHunting for Bugs, Catching DragonsNicolas Joly · Black Hat USA 2019
• 49mDeserialization vulns: past, present, and futureMykhayl Shcherbakov · DotNext 2019 Piter
• 47mToolShell, Patch Bypass, and the AI That Might Have Seen It ComingPedram Hayati, Soroush Dalili · NDC Manchester 2025
• 28mLearning from High Profile FailuresDanielle Adams · ReactiveConf 2019
• 01h 05mClassic VulnerabilitiesPatricia Aas · NDC Security 2022
• 50mPwnie Awards 2016Black Hat USA 2016