zerothoughts

[zerothoughts @zerothinking]

@matthias_kaiser Good find

[zerothoughts @zerothinking]

@will_sargent Looks like simple sandbox escape. By stopping thread at right time, you could call defaultReadObject() from another thread.

[zerothoughts @zerothinking]

JRE 1.8.0_91 check untrusted #javadeser through RMI. Remote's implementing DeserializationChecker are validated. JMXRMI connector is fixed.

[Aleksei Tiurin @antyurin]

Cheat sheet about attacks on Java (de)serialization https://t.co/vFmfTDgOfE #javadeser

[zerothoughts @zerothinking]

@stephendv Most responsible vendors would fix this. I have reported similar issues to Oracle who are taking them serious.

[zerothoughts @zerothinking]

@frohoff don't be modest. 2 years ago it was. Good find.

[zerothoughts @zerothinking]

The holy grail of java deserialization gadgets. https://t.co/w3Csti7SYb

[Chris Frohoff @frohoff]

My advisory/write-up on an interesting Java deser gadget chain in JRE <= 1.7u21 https://t.co/MVS2oIP5Qs #oneyearlater at @AppSecCali again

[zerothoughts @zerothinking]

@krelnik I checked the source, looks like Spring 3.x has the same issue.

[Ionut Popescu @NytroRST]

Bypass PHP safe mode by abusing SQLite3’s FTS tokenizer https://t.co/QU5arURlvu

[zerothoughts @zerothinking]

@dronesec I fully agree with you. Apache's bug caused several remote RCE in big projects. https://t.co/YGuJq3OBBm

[zerothoughts @zerothinking]

@dronesec code execution through deserialization should not be possible. Like issue in Apache Commons @frohoff reported in 2015.

[zerothoughts @zerothinking]

@frohoff Im writing you a patch for ysoserial to include this one

[zerothoughts @zerothinking]

Unpatched java bytecode injection in Spring Framework through untrusted deserialization,
https://t.co/04Fx4Z0xKn
#java #server #0day

[zerothoughts @zerothinking]

Fun with JNDI and java deserialization - https://t.co/ds4LydVxKm
#0day #java #server #exploit technique