4 ms·
I had shock and awe when I learnt how to exploit PHP's unserialize() vulnerabilities, shock when I learnt Python had the same thing with unpickle, and then some
by technion 9y ago
I had shock and awe when I learnt how to exploit PHP's unserialize() vulnerabilities, shock when I learnt Python had the same thing with unpickle, and then somewhat lost the plot reading about a previous Rails vulnerability which looks very much like this struts vulnerability.
It's unsurprising someone, somehow, built the same thing for Java, but I wish we'd move from "don't unserialize unless it's safe" to "this language should not have this feature".
- needusername 9y agoWell, the intended goal of the plugin in question is to enable Rails-like functionality [1]. So if they took inspiration from there it's not that surprising if they end up with the same vulnerabilities. [1] http://struts.apache.org/docs/rest-plugin.html http://struts.apache.org/docs/rest-plugin.html
- runeks 9y agoIn my humble opinion, when a remote code execution vulnerability appears in an application written in a memory safe language, you know you’ve chosen the wrong way to model a problem. The art of writing code is defining the problem space, which is avoided completely when you allow the consumer of your interface to execute arbitrary code. The whole point of interfaces is to restrict the possible actions of a consumer of it — i.e. the inverse of arbitrary remote code execution — which is the hard part of software design.
- BrandoElFollito 9y agoI am not sure what you mean with Python and pickle. You get a binary blob with data (dict, list,...) as an input and bring these data in memory. This is the same as reading a file in, getting data though a http call, through user input... Of course you must marshall what you get before using it further - but that does not depend on the source once it is not secure /trusted