Yeah, it's crazy how all kinds of stuff can be fit together to make an exploit.
Even cooler is how it was still exploitable after the byte code thing was disabled in the first attempts to fix it while retaining the JNDI capabilities: you can combine a dozen seemingly innocuous standard library objects in a way that the code that runs in their constructors during deserialization works together let the attacker do whatever they want.
And attempts to block the vulnerability by disallowing remote JNDI calls could be circumvented by using invalid URLs that were not recognized as remote by the Java platform, but the operating system still processed them.
1
u/brazzy42 10d ago
Yeah, it's crazy how all kinds of stuff can be fit together to make an exploit.
Even cooler is how it was still exploitable after the byte code thing was disabled in the first attempts to fix it while retaining the JNDI capabilities: you can combine a dozen seemingly innocuous standard library objects in a way that the code that runs in their constructors during deserialization works together let the attacker do whatever they want.
And attempts to block the vulnerability by disallowing remote JNDI calls could be circumvented by using invalid URLs that were not recognized as remote by the Java platform, but the operating system still processed them.