3 ms·
Nobody wants to hand a bunch of blackhats a working exploit without there being a patch available. But yeah, at some point you have to accept that the blackhats
by freeqaz 5y ago
Nobody wants to hand a bunch of blackhats a working exploit without there being a patch available. But yeah, at some point you have to accept that the blackhats have it and it's "more ethical" to just start handing out the exploit POC so that companies can start testing their ability to detect + remediate the issue.
It's the whole "responsible disclosure" dance. Finding a 0-day is exciting as a researcher, but you have to keep your mouth shut while a fix gets built and tested. (Google's Project Zero gives a 90 day grace period, for example)
- EE84M3i 5y agoThe post says "there is a public proof-of-concept available." If that's true, just link to it. The cat's already out of the bag.
- freeqaz 5y agoThanks for pointing that out -- I didn't realize we missed adding the link! It's in a repo on GitHub, and we were banging on it to verify the exploit prerequisites. I'll go do that as soon as I sit down again.
- cyberpunk 5y agoI still can't find it.. Got the link to the repo?
- freeqaz 5y agoI'll ask my engineers to post the one he wrote. He did put more details into the article, so go check that. Here is a repo with a POC though: https://github.com/TheGejr/SpringShell https://github.com/TheGejr/SpringShell
- vips7L 5y agoThat’s not really a POC though. That’s not a Spring Application I can run and reproduce on. That’s just a py script.
- growse 5y agoThe PDF in the repo contains a simple Java sample that should be straightforward to build and run.
- vips7L 5y agoYeah it doesn't work with a default Spring MVC project from start.spring.io on Jdk 18. It's hardly a proof of concept without any configuration details of the spring project. Security researchers need to do better than this.
- freeqaz 5y agoCheck the post again. We made a repo with a full end to end vulnerable app and POC
- hsbauauvhabzb 5y agoHow is handing out a poc 0day ethical when it’s leaked but difficult to find? I’d rather see it censored until at least a patch drops + grace period. I guess it’s a case by case basis, adding app-specific waf rules will be handy, but that only matters if exploitation patterns are unique per applications, otherwise generic rules could be published.
- EdwardDiego 5y agoThe whole basis of this claim was a commit in a merged PR yeah?
- richbell 5y agoNo. There was a credible report, but one of the blogs (Cyber Kendra) linked to a commit that mentioned RCE off hand and said "it looks like they're cleaning up". https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement https://spring.io/blog/2022/03/31/spring-framework-rce-early...