3 ms·

>Injecting a JSON blob to the Struts REST deserializer that effectively results in executing payload code would indicate high investment in the attack. Why doe

>Injecting a JSON blob to the Struts REST deserializer that effectively results in executing payload code would indicate high investment in the attack. Why does it indicate high investment? IMO it's similar to SQL injection attack. People, just take a look at points where complicated data can be deserialized and check whether adequate checks can be overcome. As I see from their report here: https://cwiki.apache.org/confluence/display/WW/S2-052 https://cwiki.apache.org/confluence/display/WW/S2-052 they use XStream to deserialize REST data. XStream is basically Java serialization/deserialization to XML instead of binary. As far as I remember from my experience of working with XStream, XStream can deserialize almost any object, even the ones which aren't serializable by default. It's quite trivial to go from here to execution of arbitrary code.

matchagaucho 9y ago
> It's quite trivial to go from here to execution of arbitrary code. Code that does what? Dumps all environment vars? OK, maybe that produces a DB2 connection string. Refactor code, re-inject, does the connection work? OK. Refactor code, re-inject and dump all tables. etc... This attack requires an iterative trial-and-error probing process, typically done behind a proxy for many weeks/months. From Equifax's PR: "the unauthorized access occurred from mid-May through July 2017.". That's a reasonable amount of time to probe all systems involved and develop sophisticated code.
- solomatov 9y ago
  >This attack requires an iterative trial-and-error probing process, typically done behind a proxy for many weeks/months. Of course this attack is quite laborious, but it doesn't require anything special or unique.
  - tetha 9y ago
    It requires human effort. For most attackers, it is vastly more efficient to run automated sql/wordpress-vuln/ssh-user scanners dropping bitcoin miners and botnet nodes. Those require zero human effort and self-replicate. That gives you less publicity than a hundred million personal finance records, but it has a much higher success chance and a more reliable income.
- sasas 9y ago
  The vulnerabilities have public proof of concept code. You literally get a shell on the machine. I wont link examples here, but they are east to find.

matchagaucho 9y ago

> It's quite trivial to go from here to execution of arbitrary code. Code that does what? Dumps all environment vars? OK, maybe that produces a DB2 connection string. Refactor code, re-inject, does the connection work? OK. Refactor code, re-inject and dump all tables. etc... This attack requires an iterative trial-and-error probing process, typically done behind a proxy for many weeks/months. From Equifax's PR: "the unauthorized access occurred from mid-May through July 2017.". That's a reasonable amount of time to probe all systems involved and develop sophisticated code.

solomatov 9y ago
>This attack requires an iterative trial-and-error probing process, typically done behind a proxy for many weeks/months. Of course this attack is quite laborious, but it doesn't require anything special or unique.
- tetha 9y ago
  It requires human effort. For most attackers, it is vastly more efficient to run automated sql/wordpress-vuln/ssh-user scanners dropping bitcoin miners and botnet nodes. Those require zero human effort and self-replicate. That gives you less publicity than a hundred million personal finance records, but it has a much higher success chance and a more reliable income.
sasas 9y ago
The vulnerabilities have public proof of concept code. You literally get a shell on the machine. I wont link examples here, but they are east to find.