Other nomination

RCE through mangled WAR upload into Tomcat App Manager using PUT-in-Gopher-over-XXE

George Noseevich and Andrew Petukhov · slideshare.net

ZeroNights 2012 deck chaining local file read and SSRF into full compromise of ForgeRock OpenAM on Tomcat. Blind XXE lists directories and reads configs, then gopher carries an HTTP PUT that uploads a store-compressed WAR whose checksums Tomcat tolerates, giving RCE. Further slides force debug logging by CSRF, hijack admin sessions and dump the heap to recover the encryption key.

Record

Researcher

George Noseevich and Andrew Petukhov

Published by

slideshare.net

Format

Slides

In the archive

• Nominated for the 2012 Top 10 Web Hacking Techniques

Related sources

• video

Tags

• xxe
• ssrf
• rce
• java
• lfi
• file-upload
• attack-chain
• auth-bypass
• owasp-a01-2021
• owasp-a03-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of George Noseevich and Andrew Petukhov, first published at the original source. Preserved copies are kept so the citation survives its host.