WEBVTT

1
00:00:04.000 --> 00:00:06.000
<00:00:04.000>A <00:00:04.155>little <00:00:04.311>bit <00:00:04.466>of <00:00:04.622>disclaimer. <00:00:04.777>This <00:00:04.933>talk <00:00:05.088>is <00:00:05.244>not <00:00:05.400>mine.

2
00:00:06.020 --> 00:00:10.040
<00:00:06.020>It <00:00:06.136>is <00:00:06.253>from <00:00:06.369>my <00:00:06.486>dearest <00:00:06.603>team <00:00:06.720>colleague, <00:00:06.836>uh, <00:00:06.953>al, <00:00:07.069>who <00:00:07.186>couldn't <00:00:07.303>come <00:00:07.420>today.

3
00:00:10.640 --> 00:00:13.600
<00:00:10.640>I <00:00:10.780>won't <00:00:10.920>have <00:00:11.060>the <00:00:11.200>funny <00:00:11.340>fat <00:00:11.480>that <00:00:11.620>he <00:00:11.760>is <00:00:11.900>always <00:00:12.040>wearing,

4
00:00:13.820 --> 00:00:17.960
<00:00:13.820>but <00:00:13.947>today <00:00:14.074>I'm <00:00:14.201>AC <00:00:14.329>company <00:00:14.456>with <00:00:14.583>Patch. <00:00:14.710>So <00:00:14.838>I'll <00:00:14.965>try <00:00:15.092>to, <00:00:15.220>uh,

5
00:00:19.380 --> 00:00:24.200
<00:00:19.380>to <00:00:19.507>be <00:00:19.634>as <00:00:19.761>funny <00:00:19.889>as, <00:00:20.016>as <00:00:20.143>Iran. <00:00:20.270>Anyway. <00:00:20.398>So, <00:00:20.525>um, <00:00:20.652>I'm <00:00:20.779>sse,

6
00:00:24.340 --> 00:00:28.240
<00:00:24.340>I'm <00:00:24.480>a <00:00:24.620>senior <00:00:24.759>security <00:00:24.900>advocate, <00:00:25.040>uh, <00:00:25.180>at <00:00:25.320>Snic, <00:00:25.460>passionate <00:00:25.600>about <00:00:25.740>DevSecOps,

7
00:00:28.440 --> 00:00:31.560
<00:00:28.440>op <00:00:28.556>source <00:00:28.673>in <00:00:28.790>cloud <00:00:28.906>security. <00:00:29.023>I <00:00:29.140>do <00:00:29.256>other <00:00:29.373>things, <00:00:29.490>uh, <00:00:29.606>outside <00:00:29.723>of <00:00:29.840>Snic.

8
00:00:31.580 --> 00:00:35.160
<00:00:31.580>I'm <00:00:31.680>not <00:00:31.779>gonna <00:00:31.880>bother <00:00:31.979>you <00:00:32.080>for <00:00:32.180>with <00:00:32.280>this <00:00:32.379>today, <00:00:32.479>but <00:00:32.580>you <00:00:32.680>can <00:00:32.780>link <00:00:32.879>up, <00:00:32.980>uh,

9
00:00:35.160 --> 00:00:39.830
<00:00:35.160>with <00:00:35.334>me <00:00:35.510>on <00:00:35.684>LinkedIn. <00:00:35.860>So, <00:00:36.035>at <00:00:36.209>first, <00:00:36.385>as <00:00:36.559>developer,

10
00:00:39.930 --> 00:00:43.950
<00:00:39.930>we <00:00:40.057>are <00:00:40.184>usually <00:00:40.311>often <00:00:40.439>made <00:00:40.566>aware <00:00:40.693>from <00:00:40.820>the <00:00:40.948>general <00:00:41.075>public <00:00:41.202>concern <00:00:41.330>that

11
00:00:44.340 --> 00:00:46.550
<00:00:44.340>application <00:00:44.620>security <00:00:44.900>related <00:00:45.180>to <00:00:45.460>a <00:00:45.740>topic.

12
00:00:47.890 --> 00:00:52.030
<00:00:47.890>And <00:00:47.967>we <00:00:48.045>do <00:00:48.123>have <00:00:48.201>a <00:00:48.278>lot <00:00:48.356>of <00:00:48.434>security <00:00:48.512>issues <00:00:48.590>that <00:00:48.667>met <00:00:48.745>us <00:00:48.823>when <00:00:48.901>we <00:00:48.978>install <00:00:49.056>new <00:00:49.134>N <00:00:49.212>P <00:00:49.290>M

13
00:00:52.030 --> 00:00:52.450
packages,

14
00:00:52.450 --> 00:00:56.070
<00:00:52.450>or <00:00:52.577>we've <00:00:52.704>seen <00:00:52.831>some <00:00:52.959>major <00:00:53.086>security <00:00:53.213>vulnerabilities <00:00:53.340>that <00:00:53.468>might <00:00:53.595>be <00:00:53.722>discovered <00:00:53.850>for

15
00:00:56.070 --> 00:01:01.030
<00:00:56.070>packages <00:00:56.186>that <00:00:56.303>we <00:00:56.420>regularly <00:00:56.536>use <00:00:56.653>or <00:00:56.770>when <00:00:56.886>we've <00:00:57.003>seen <00:00:57.120>malicious <00:00:57.236>packages <00:00:57.353>may <00:00:57.470>news

16
00:01:01.350 --> 00:01:04.710
<00:01:01.350>headlines. <00:01:01.466>So <00:01:01.583>today <00:01:01.700>I <00:01:01.816>would <00:01:01.933>like <00:01:02.050>to <00:01:02.166>share <00:01:02.283>a <00:01:02.400>little <00:01:02.516>bit <00:01:02.633>of, <00:01:02.750>uh,

17
00:01:04.910 --> 00:01:09.150
<00:01:04.910>security <00:01:05.026>knowledge <00:01:05.143>with <00:01:05.259>you <00:01:05.376>about <00:01:05.493>path <00:01:05.610>reversal <00:01:05.726>vulnerability <00:01:05.843>and <00:01:05.960>why <00:01:06.076>is <00:01:06.193>it <00:01:06.310>a

18
00:01:09.150 --> 00:01:11.870
<00:01:09.150>significant, <00:01:09.350>uh, <00:01:09.550>security <00:01:09.750>weakness <00:01:09.950>that <00:01:10.150>has <00:01:10.350>high <00:01:10.550>impacts.

19
00:01:12.330 --> 00:01:15.350
<00:01:12.330>And <00:01:12.485>it <00:01:12.641>comes <00:01:12.796>from <00:01:12.952>anywhere <00:01:13.107>from <00:01:13.263>web <00:01:13.418>applications <00:01:13.574>to <00:01:13.730>routers.

20
00:01:17.250 --> 00:01:21.880
<00:01:17.250>And <00:01:17.425>with <00:01:17.600>this, <00:01:17.775>uh, <00:01:17.950>and <00:01:18.125>with <00:01:18.300>this <00:01:18.475>new <00:01:18.650>learnings,

21
00:01:22.060 --> 00:01:26.160
<00:01:22.060>um, <00:01:22.200>we'll <00:01:22.340>try <00:01:22.480>to <00:01:22.620>have <00:01:22.760>those <00:01:22.900>patterns <00:01:23.040>and <00:01:23.180>recognize <00:01:23.320>the <00:01:23.460>code.

22
00:01:26.160 --> 00:01:30.000
<00:01:26.160>And <00:01:26.300>more <00:01:26.440>importantly, <00:01:26.580>you'll <00:01:26.720>have <00:01:26.860>those, <00:01:27.000>um, <00:01:27.140>new <00:01:27.280>security <00:01:27.420>coding <00:01:27.560>skills.

23
00:01:31.200 --> 00:01:33.780
<00:01:31.200>So <00:01:31.340>first <00:01:31.480>of <00:01:31.620>all, <00:01:31.760>let's <00:01:31.900>sify <00:01:32.040>what <00:01:32.180>is <00:01:32.320>path <00:01:32.460>vessel? <00:01:32.600>Because,

24
00:01:33.780 --> 00:01:35.780
<00:01:33.780>because <00:01:33.935>you <00:01:34.091>might <00:01:34.246>be <00:01:34.402>asking <00:01:34.557>what <00:01:34.713>is <00:01:34.868>she <00:01:35.024>talking <00:01:35.180>about?

25
00:01:35.800 --> 00:01:39.220
<00:01:35.800>So <00:01:35.927>let's <00:01:36.054>take <00:01:36.181>a <00:01:36.309>second <00:01:36.436>to <00:01:36.563>actually <00:01:36.690>define <00:01:36.818>what <00:01:36.945>is <00:01:37.072>path <00:01:37.200>vessel.

26
00:01:39.560 --> 00:01:44.060
<00:01:39.560>So <00:01:39.715>this <00:01:39.871>is <00:01:40.026>the <00:01:40.182>dictionary <00:01:40.337>definition <00:01:40.493>for <00:01:40.648>path <00:01:40.804>vessel. <00:01:40.960>Uh,

27
00:01:44.120 --> 00:01:45.940
<00:01:44.120>as <00:01:44.353>you <00:01:44.586>can <00:01:44.820>see, <00:01:45.053>a <00:01:45.286>directory <00:01:45.520>reversal,

28
00:01:45.940 --> 00:01:50.420
<00:01:45.940>attack <00:01:46.080>exploits <00:01:46.220>efficient <00:01:46.360>security <00:01:46.500>validation <00:01:46.640>or <00:01:46.780>sensation <00:01:46.920>of <00:01:47.060>user <00:01:47.200>supplied <00:01:47.340>file

29
00:01:50.430 --> 00:01:54.620
<00:01:50.430>names <00:01:50.570>such <00:01:50.710>that <00:01:50.850>characters <00:01:50.990>representing <00:01:51.130>traverse <00:01:51.270>two <00:01:51.410>parent <00:01:51.550>directory <00:01:51.690>are <00:01:51.830>passed

30
00:01:54.620 --> 00:01:59.540
<00:01:54.620>through <00:01:54.747>CD <00:01:54.874>operating <00:01:55.001>systems <00:01:55.129>file <00:01:55.256>system. <00:01:55.383>A <00:01:55.510>p <00:01:55.638>i, <00:01:55.765>it's <00:01:55.892>quite <00:01:56.020>verbose,

31
00:01:59.720 --> 00:02:02.540
<00:01:59.720>uh, <00:01:59.875>but <00:02:00.031>if <00:02:00.186>we're <00:02:00.342>actually <00:02:00.497>highlighting <00:02:00.653>some <00:02:00.808>of <00:02:00.964>the <00:02:01.120>terms,

32
00:02:02.720 --> 00:02:07.460
<00:02:02.720>we <00:02:02.827>can <00:02:02.935>see <00:02:03.043>that <00:02:03.150>we're <00:02:03.258>calling <00:02:03.366>out <00:02:03.473>the <00:02:03.581>relevant <00:02:03.689>actor <00:02:03.796>here <00:02:03.904>is <00:02:04.012>the <00:02:04.120>Visal

33
00:02:07.460 --> 00:02:09.260
<00:02:07.460>vulnerability <00:02:07.809>due <00:02:08.160>to <00:02:08.509>insecure <00:02:08.859>coding,

34
00:02:10.590 --> 00:02:14.090
<00:02:10.590>and <00:02:10.717>also <00:02:10.844>the <00:02:10.971>sources <00:02:11.099>coming <00:02:11.226>from <00:02:11.353>end <00:02:11.480>users, <00:02:11.608>uh, <00:02:11.735>supplied <00:02:11.862>file <00:02:11.990>name.

35
00:02:16.250 --> 00:02:19.710
<00:02:16.250>And <00:02:16.366>then <00:02:16.483>it <00:02:16.600>goes <00:02:16.716>through, <00:02:16.833>uh, <00:02:16.950>traversing <00:02:17.066>those <00:02:17.183>directory <00:02:17.300>goes <00:02:17.416>through <00:02:17.533>the, <00:02:17.650>uh,

36
00:02:19.710 --> 00:02:24.200
<00:02:19.710>the <00:02:19.797>sync, <00:02:19.885>which <00:02:19.972>is <00:02:20.060>the, <00:02:20.147>the <00:02:20.235>file <00:02:20.322>system <00:02:20.410>a <00:02:20.497>p <00:02:20.585>i. <00:02:20.672>So <00:02:20.760>what <00:02:20.847>does <00:02:20.935>it <00:02:21.022>look <00:02:21.110>like?

37
00:02:24.560 --> 00:02:27.720
<00:02:24.560>'cause <00:02:24.660>this <00:02:24.760>was <00:02:24.860>the, <00:02:24.960>uh, <00:02:25.060>quite <00:02:25.160>verb <00:02:25.260>definition, <00:02:25.360>what <00:02:25.460>it <00:02:25.560>looks <00:02:25.660>like <00:02:25.760>in <00:02:25.860>the, <00:02:25.960>um,

38
00:02:28.260 --> 00:02:32.440
<00:02:28.260>uh, <00:02:28.367>concrete <00:02:28.475>lead. <00:02:28.583>So <00:02:28.690>here <00:02:28.798>you <00:02:28.906>have <00:02:29.013>an <00:02:29.121>example <00:02:29.229>of, <00:02:29.336>uh, <00:02:29.444>a <00:02:29.552>curl <00:02:29.660>requests,

39
00:02:32.540 --> 00:02:36.720
<00:02:32.540>and <00:02:32.656>you <00:02:32.773>can <00:02:32.890>see <00:02:33.006>the, <00:02:33.123>um, <00:02:33.239>the <00:02:33.356>u <00:02:33.473>l, <00:02:33.590>uh, <00:02:33.706>with <00:02:33.823>the <00:02:33.940>example.com,

40
00:02:36.740 --> 00:02:41.240
<00:02:36.740>the.dot <00:02:36.973>slash.dot/config <00:02:37.206>json. <00:02:37.440>And <00:02:37.673>this <00:02:37.906>is <00:02:38.140>the,

41
00:02:41.520 --> 00:02:42.600
<00:02:41.520>that <00:02:41.844>has <00:02:42.168>been <00:02:42.492>requested.

42
00:02:43.100 --> 00:02:46.720
<00:02:43.100>So <00:02:43.227>the <00:02:43.354>dot <00:02:43.481>dots <00:02:43.609>slash <00:02:43.736>part <00:02:43.863>will <00:02:43.990>navigate <00:02:44.118>up <00:02:44.245>to <00:02:44.372>the <00:02:44.500>directory.

43
00:02:46.740 --> 00:02:50.200
<00:02:46.740>So <00:02:46.867>this <00:02:46.994>is <00:02:47.121>attempting <00:02:47.249>to <00:02:47.376>access <00:02:47.503>the, <00:02:47.630>uh, <00:02:47.758>the <00:02:47.885>config <00:02:48.012>json <00:02:48.140>file,

44
00:02:50.200 --> 00:02:54.000
<00:02:50.200>which <00:02:50.316>is <00:02:50.433>outside <00:02:50.549>of <00:02:50.666>the <00:02:50.783>normal <00:02:50.899>document <00:02:51.016>route. <00:02:51.133>And <00:02:51.250>then <00:02:51.366>we <00:02:51.483>have <00:02:51.600>the,

45
00:02:54.180 --> 00:02:56.840
<00:02:54.180>the <00:02:54.335>flag <00:02:54.491>path <00:02:54.646>at <00:02:54.802>is <00:02:54.957>this <00:02:55.113>is <00:02:55.268>to <00:02:55.424>tell <00:02:55.580>curl,

46
00:02:56.900 --> 00:03:01.560
<00:02:56.900>to <00:02:57.016>not <00:02:57.133>normalize <00:02:57.250>the <00:02:57.366>path <00:02:57.483>by <00:02:57.600>removing <00:02:57.716>the.dot/and <00:02:57.833>so <00:02:57.950>we're <00:02:58.066>having <00:02:58.183>the <00:02:58.300>full

47
00:03:01.880 --> 00:03:03.960
<00:03:01.880>relative, <00:03:02.160>uh, <00:03:02.440>relative <00:03:02.720>path <00:03:03.000>as <00:03:03.280>requested.

48
00:03:04.540 --> 00:03:08.240
<00:03:04.540>And <00:03:04.640>what <00:03:04.739>we're <00:03:04.840>saying <00:03:04.940>here <00:03:05.040>is <00:03:05.140>actually <00:03:05.239>we <00:03:05.340>have <00:03:05.440>access <00:03:05.540>to <00:03:05.640>that <00:03:05.739>Jason <00:03:05.840>body <00:03:05.940>and

49
00:03:08.440 --> 00:03:12.680
<00:03:08.440>surprise <00:03:08.547>surprise, <00:03:08.655>we <00:03:08.763>have <00:03:08.870>a <00:03:08.978>db, <00:03:09.086>uh, <00:03:09.193>password, <00:03:09.301>uh, <00:03:09.409>in <00:03:09.516>the, <00:03:09.624>in <00:03:09.732>a <00:03:09.840>sense.

50
00:03:12.700 --> 00:03:16.200
<00:03:12.700>So <00:03:12.816>here <00:03:12.933>the <00:03:13.049>remediation <00:03:13.166>would <00:03:13.283>be <00:03:13.399>to <00:03:13.516>change <00:03:13.633>the, <00:03:13.750>uh, <00:03:13.866>the <00:03:13.983>password, <00:03:14.100>uh,

51
00:03:17.100 --> 00:03:21.870
<00:03:17.100>for <00:03:17.299>that <00:03:17.500>one. <00:03:17.700>So <00:03:17.900>you <00:03:18.100>might <00:03:18.299>have <00:03:18.500>been,

52
00:03:22.050 --> 00:03:26.230
<00:03:22.050>um, <00:03:22.177>um, <00:03:22.304>you <00:03:22.431>might <00:03:22.559>have <00:03:22.686>seen <00:03:22.813>a <00:03:22.940>lot <00:03:23.068>of <00:03:23.195>security <00:03:23.322>vulnerabilities, <00:03:23.450>uh,

53
00:03:26.450 --> 00:03:27.350
<00:03:26.450>in <00:03:26.855>like <00:03:27.260>reports.

54
00:03:27.490 --> 00:03:29.950
<00:03:27.490>And <00:03:27.617>you <00:03:27.744>might <00:03:27.871>be <00:03:27.999>wondering <00:03:28.126>why <00:03:28.253>are <00:03:28.380>we <00:03:28.508>talking <00:03:28.635>about <00:03:28.762>petro <00:03:28.890>vessel?

55
00:03:30.350 --> 00:03:33.670
<00:03:30.350>'cause <00:03:30.457>you <00:03:30.565>might <00:03:30.673>be <00:03:30.780>more <00:03:30.888>familiar <00:03:30.996>with <00:03:31.103>Xs <00:03:31.211>s <00:03:31.319>report <00:03:31.426>type <00:03:31.534>pollution <00:03:31.642>and <00:03:31.750>others.

56
00:03:35.210 --> 00:03:37.710
<00:03:35.210>And <00:03:35.350>also <00:03:35.490>actually, <00:03:35.630>if <00:03:35.770>we're <00:03:35.910>looking <00:03:36.050>at <00:03:36.190>the <00:03:36.330>S <00:03:36.470>top <00:03:36.610>10,

57
00:03:37.710 --> 00:03:39.550
<00:03:37.710>which <00:03:38.060>is <00:03:38.410>an <00:03:38.760>awareness <00:03:39.110>documents,

58
00:03:39.550 --> 00:03:42.630
<00:03:39.550>which <00:03:39.705>is <00:03:39.861>listing <00:03:40.016>the <00:03:40.172>top <00:03:40.327>most <00:03:40.483>common <00:03:40.638>web <00:03:40.794>security <00:03:40.950>vulnerabilities,

59
00:03:42.890 --> 00:03:46.760
<00:03:42.890>pet <00:03:43.123>reversal <00:03:43.356>isn't <00:03:43.589>even <00:03:43.823>there. <00:03:44.056>But <00:03:44.290>actually,

60
00:03:46.860 --> 00:03:50.720
<00:03:46.860>if <00:03:47.015>we're <00:03:47.171>looking <00:03:47.326>at <00:03:47.482>the <00:03:47.637>consequences, <00:03:47.793>repercussions <00:03:47.948>of <00:03:48.104>pet <00:03:48.260>reversal,

61
00:03:51.300 --> 00:03:55.400
<00:03:51.300>you <00:03:51.407>can <00:03:51.515>see <00:03:51.623>that <00:03:51.730>it's <00:03:51.838>quite <00:03:51.946>simple <00:03:52.053>to <00:03:52.161>execute <00:03:52.269>because <00:03:52.376>in <00:03:52.484>my <00:03:52.592>similar <00:03:52.700>bit

62
00:03:55.400 --> 00:03:59.400
<00:03:55.400>harmless, <00:03:55.540>but <00:03:55.680>the <00:03:55.820>impact <00:03:55.960>is, <00:03:56.100>can <00:03:56.240>be <00:03:56.380>wide <00:03:56.520>reaching <00:03:56.660>and <00:03:56.800>sating.

63
00:04:00.380 --> 00:04:01.920
<00:04:00.380>So <00:04:00.578>here <00:04:00.775>on <00:04:00.974>the, <00:04:01.172>on <00:04:01.370>the <00:04:01.567>right <00:04:01.766>side,

64
00:04:01.920 --> 00:04:06.200
<00:04:01.920>you're <00:04:02.027>seeing <00:04:02.135>that <00:04:02.243>the <00:04:02.350>first <00:04:02.458>primary <00:04:02.566>concern <00:04:02.673>is <00:04:02.781>to <00:04:02.889>be <00:04:02.996>aware <00:04:03.104>of <00:04:03.212>is <00:04:03.320>sensitive

65
00:04:06.200 --> 00:04:09.200
<00:04:06.200>information <00:04:06.355>exposure. <00:04:06.511>And <00:04:06.666>you <00:04:06.822>can <00:04:06.977>see <00:04:07.133>the <00:04:07.288>type <00:04:07.444>of, <00:04:07.600>um,

66
00:04:09.570 --> 00:04:11.160
<00:04:09.570>files <00:04:09.803>that <00:04:10.036>you <00:04:10.269>might <00:04:10.503>have <00:04:10.736>access <00:04:10.970>to.

67
00:04:11.180 --> 00:04:15.520
<00:04:11.180>So <00:04:11.287>coffee <00:04:11.395>esson <00:04:11.503>the <00:04:11.610>list <00:04:11.718>of <00:04:11.826>packaged <00:04:11.933>do <00:04:12.041>Jason. <00:04:12.149>And <00:04:12.256>you <00:04:12.364>might <00:04:12.472>be <00:04:12.580>thinking,

68
00:04:15.990 --> 00:04:18.480
<00:04:15.990>what <00:04:16.165>is <00:04:16.340>harmful <00:04:16.515>about <00:04:16.690>knowing <00:04:16.865>the <00:04:17.040>package? <00:04:17.215>Do <00:04:17.390>Jason.

69
00:04:18.620 --> 00:04:21.240
<00:04:18.620>But <00:04:18.820>actually <00:04:19.019>by <00:04:19.220>knowing <00:04:19.420>the, <00:04:19.620>the <00:04:19.820>specific <00:04:20.019>version,

70
00:04:21.380 --> 00:04:24.480
<00:04:21.380>you <00:04:21.519>can <00:04:21.659>actually <00:04:21.800>build <00:04:21.940>up <00:04:22.079>and <00:04:22.219>coming <00:04:22.360>through <00:04:22.500>the <00:04:22.640>second <00:04:22.780>one,

71
00:04:24.740 --> 00:04:27.640
<00:04:24.740>do <00:04:24.867>vulnerability <00:04:24.994>chaining. <00:04:25.121>So <00:04:25.249>do <00:04:25.376>a <00:04:25.503>little <00:04:25.630>bit <00:04:25.758>of <00:04:25.885>recon <00:04:26.012>at <00:04:26.140>first,

72
00:04:27.660 --> 00:04:32.200
<00:04:27.660>and <00:04:27.787>then <00:04:27.914>you <00:04:28.041>actually, <00:04:28.169>uh, <00:04:28.296>exploit <00:04:28.423>the, <00:04:28.550>and <00:04:28.678>weaponize <00:04:28.805>the, <00:04:28.932>that <00:04:29.060>vulnerability.

73
00:04:37.210 --> 00:04:41.390
<00:04:37.210>So <00:04:37.317>let's <00:04:37.425>see, <00:04:37.533>um, <00:04:37.640>some <00:04:37.748>examples <00:04:37.856>of <00:04:37.963>pet <00:04:38.071>reversal <00:04:38.179>in <00:04:38.286>the, <00:04:38.394>in <00:04:38.502>the <00:04:38.609>walls.

74
00:04:42.370 --> 00:04:45.030
<00:04:42.370>So <00:04:42.570>the <00:04:42.770>first <00:04:42.970>one <00:04:43.170>is, <00:04:43.370>uh, <00:04:43.570>Zimbra. <00:04:43.770>Uh,

75
00:04:45.230 --> 00:04:49.790
<00:04:45.230>Zimbra <00:04:45.357>is <00:04:45.484>an <00:04:45.611>enterprise <00:04:45.739>ready <00:04:45.866>email <00:04:45.993>solution <00:04:46.120>used <00:04:46.248>by <00:04:46.375>over <00:04:46.502>200,000 <00:04:46.630>businesses,

76
00:04:49.920 --> 00:04:52.030
<00:04:49.920>government <00:04:50.386>and <00:04:50.853>financial <00:04:51.320>institutions.

77
00:04:52.450 --> 00:04:57.320
<00:04:52.450>And <00:04:52.625>the <00:04:52.800>Zimbra <00:04:52.974>instances <00:04:53.150>recently <00:04:53.325>became <00:04:53.500>a <00:04:53.675>target <00:04:53.849>of

78
00:04:57.440 --> 00:04:58.840
<00:04:57.440>a <00:04:57.755>zero <00:04:58.070>day <00:04:58.385>attack <00:04:58.700>campaign.

79
00:04:58.980 --> 00:05:03.560
<00:04:58.980>So <00:04:59.120>it's <00:04:59.260>slightly <00:04:59.400>conducted <00:04:59.540>by <00:04:59.680>a <00:04:59.820>state <00:04:59.960>actor <00:05:00.100>who <00:05:00.240>targeted <00:05:00.380>European

80
00:05:03.560 --> 00:05:05.200
<00:05:03.560>governments <00:05:04.026>and <00:05:04.493>media <00:05:04.960>instances.

81
00:05:05.620 --> 00:05:08.880
<00:05:05.620>And <00:05:05.727>you <00:05:05.835>might <00:05:05.943>be <00:05:06.050>thinking <00:05:06.158>actually <00:05:06.266>the <00:05:06.373>fact <00:05:06.481>that <00:05:06.589>a <00:05:06.696>zero <00:05:06.804>day <00:05:06.912>vulnerability <00:05:07.020>was

82
00:05:08.880 --> 00:05:11.520
<00:05:08.880>used <00:05:09.159>to <00:05:09.440>steal <00:05:09.719>emails <00:05:10.000>from <00:05:10.280>individuals.

83
00:05:11.640 --> 00:05:16.640
<00:05:11.640>User <00:05:11.756>accounts <00:05:11.873>show <00:05:11.990>how <00:05:12.106>valuable <00:05:12.223>a <00:05:12.340>compromised <00:05:12.456>email <00:05:12.573>account <00:05:12.690>is <00:05:12.806>to <00:05:12.923>an <00:05:13.039>attacker

84
00:05:16.640 --> 00:05:20.160
<00:05:16.640>and <00:05:16.767>how <00:05:16.894>disastrous <00:05:17.021>the <00:05:17.149>impact <00:05:17.276>of <00:05:17.403>such <00:05:17.530>vulnerability <00:05:17.658>is <00:05:17.785>for <00:05:17.912>an <00:05:18.039>organization.

85
00:05:20.940 --> 00:05:24.720
<00:05:20.940>So <00:05:21.047>here <00:05:21.155>the <00:05:21.263>issue <00:05:21.370>is <00:05:21.478>due <00:05:21.586>to <00:05:21.693>path <00:05:21.801>reversal <00:05:21.909>in <00:05:22.016>the <00:05:22.124>under <00:05:22.232>R <00:05:22.340>utility,

86
00:05:24.720 --> 00:05:27.520
<00:05:24.720>which <00:05:24.920>was <00:05:25.120>bundled <00:05:25.320>with <00:05:25.520>the <00:05:25.720>Zimbra <00:05:25.920>collaboration <00:05:26.120>suites.

87
00:05:27.660 --> 00:05:31.600
<00:05:27.660>And <00:05:27.787>this <00:05:27.914>allows <00:05:28.041>an <00:05:28.169>attacker <00:05:28.296>to <00:05:28.423>override <00:05:28.550>arbitrary <00:05:28.678>files <00:05:28.805>on <00:05:28.932>the <00:05:29.060>server,

88
00:05:31.980 --> 00:05:35.000
<00:05:31.980>and <00:05:32.180>also <00:05:32.380>it <00:05:32.580>doesn't <00:05:32.780>require <00:05:32.980>authentication <00:05:33.180>to <00:05:33.380>exploit.

89
00:05:38.250 --> 00:05:43.230
<00:05:38.250>So <00:05:38.343>here <00:05:38.436>we <00:05:38.530>have <00:05:38.623>another <00:05:38.716>one <00:05:38.810>that <00:05:38.903>was <00:05:38.996>on <00:05:39.090>the, <00:05:39.183>uh, <00:05:39.276>Apache, <00:05:39.370>uh, <00:05:39.463>HT <00:05:39.556>P <00:05:39.650>server,

90
00:05:43.530 --> 00:05:45.190
<00:05:43.530>uh, <00:05:43.809>two <00:05:44.090>do <00:05:44.369>4 <00:05:44.650>4 <00:05:44.929>9.

91
00:05:46.250 --> 00:05:50.750
<00:05:46.250>And <00:05:46.350>here <00:05:46.450>the <00:05:46.550>proof <00:05:46.650>of <00:05:46.750>concept <00:05:46.850>was <00:05:46.950>exploding <00:05:47.050>to <00:05:47.150>show <00:05:47.250>how <00:05:47.350>to <00:05:47.450>retrieve <00:05:47.550>sens <00:05:47.650>files

92
00:05:50.780 --> 00:05:54.990
<00:05:50.780>like <00:05:50.896>the <00:05:51.013>ay <00:05:51.130>password <00:05:51.246>source <00:05:51.363>code <00:05:51.479>files <00:05:51.596>and <00:05:51.713>a <00:05:51.830>s <00:05:51.946>credentials <00:05:52.063>through <00:05:52.179>this

93
00:05:54.990 --> 00:05:59.800
<00:05:54.990>vulnerability, <00:05:55.145>because <00:05:55.301>actually <00:05:55.456>there <00:05:55.612>was <00:05:55.767>insufficient <00:05:55.923>validation <00:05:56.078>on <00:05:56.234>this <00:05:56.390>one.

94
00:06:01.810 --> 00:06:03.310
<00:06:01.810>And <00:06:02.147>here <00:06:02.485>we <00:06:02.822>have <00:06:03.160>an,

95
00:06:03.350 --> 00:06:07.710
<00:06:03.350>a <00:06:03.450>complete <00:06:03.550>patch <00:06:03.650>from <00:06:03.750>a <00:06:03.850>prior <00:06:03.950>path <00:06:04.050>to <00:06:04.150>reversal <00:06:04.250>vulnerability <00:06:04.350>in <00:06:04.450>the <00:06:04.550>Apache <00:06:04.650>HT <00:06:04.750>P

96
00:06:07.710 --> 00:06:10.270
<00:06:07.710>server. <00:06:07.989>And <00:06:08.270>also <00:06:08.549>the <00:06:08.830>same <00:06:09.109>pattern.

97
00:06:10.450 --> 00:06:13.750
<00:06:10.450>You <00:06:10.590>didn't <00:06:10.729>need <00:06:10.870>to <00:06:11.010>be <00:06:11.150>authenticated <00:06:11.289>to <00:06:11.430>actually <00:06:11.570>perform <00:06:11.710>that <00:06:11.849>vulnerability.

98
00:06:14.010 --> 00:06:17.550
<00:06:14.010>So <00:06:14.110>in <00:06:14.210>the <00:06:14.310>complete <00:06:14.409>fix, <00:06:14.510>and <00:06:14.610>you <00:06:14.710>can <00:06:14.810>see <00:06:14.909>it <00:06:15.010>is <00:06:15.110>previously <00:06:15.210>in <00:06:15.310>couple <00:06:15.409>fixed,

99
00:06:18.170 --> 00:06:21.630
<00:06:18.170>and <00:06:18.325>they <00:06:18.481>actually <00:06:18.636>had <00:06:18.792>to <00:06:18.947>release <00:06:19.103>another <00:06:19.258>fix <00:06:19.414>for <00:06:19.570>that.

100
00:06:24.820 --> 00:06:27.600
<00:06:24.820>So <00:06:24.995>how <00:06:25.170>will <00:06:25.344>we <00:06:25.520>go <00:06:25.695>to <00:06:25.870>actually <00:06:26.045>attack, <00:06:26.219>uh,

101
00:06:27.620 --> 00:06:31.360
<00:06:27.620>the <00:06:27.795>Apache <00:06:27.970>HP <00:06:28.145>server <00:06:28.320>using <00:06:28.495>this <00:06:28.670>cat <00:06:28.845>reversal <00:06:29.020>vulnerability?

102
00:06:31.580 --> 00:06:33.520
<00:06:31.580>So <00:06:31.813>here <00:06:32.046>you <00:06:32.280>can <00:06:32.513>see <00:06:32.746>the, <00:06:32.979>uh,

103
00:06:33.520 --> 00:06:37.240
<00:06:33.520>the <00:06:33.636>web <00:06:33.753>server <00:06:33.870>is <00:06:33.986>specifically <00:06:34.103>vulnerable <00:06:34.219>to <00:06:34.336>this <00:06:34.453>kind <00:06:34.570>of, <00:06:34.686>of <00:06:34.803>payloads. <00:06:34.919>Again,

104
00:06:37.240 --> 00:06:38.720
<00:06:37.240>it <00:06:37.462>looks <00:06:37.684>simple <00:06:37.906>and <00:06:38.128>it <00:06:38.350>looks <00:06:38.572>harmless,

105
00:06:39.140 --> 00:06:42.480
<00:06:39.140>but <00:06:39.295>it <00:06:39.451>could <00:06:39.606>be <00:06:39.762>potentially <00:06:39.917>devastating <00:06:40.073>by, <00:06:40.228>by <00:06:40.384>doing <00:06:40.539>this.

106
00:06:43.380 --> 00:06:47.120
<00:06:43.380>And <00:06:43.487>you <00:06:43.595>might <00:06:43.703>be <00:06:43.810>wondering, <00:06:43.918>how <00:06:44.026>do <00:06:44.133>you <00:06:44.241>get <00:06:44.349>those <00:06:44.456>kind <00:06:44.564>of <00:06:44.672>payloads? <00:06:44.780>Well,

107
00:06:47.270 --> 00:06:51.320
<00:06:47.270>it's <00:06:47.386>actually <00:06:47.503>quite <00:06:47.620>simple. <00:06:47.736>You <00:06:47.853>can <00:06:47.969>go <00:06:48.086>on <00:06:48.203>Twitter <00:06:48.320>or <00:06:48.436>x.com <00:06:48.553>now. <00:06:48.669>Um,

108
00:06:51.540 --> 00:06:55.240
<00:06:51.540>and <00:06:51.656>usually <00:06:51.773>so <00:06:51.890>you <00:06:52.006>have <00:06:52.123>some <00:06:52.240>security <00:06:52.356>researchers <00:06:52.473>or <00:06:52.590>analysts <00:06:52.706>that <00:06:52.823>will <00:06:52.940>also

109
00:06:55.240 --> 00:06:57.240
<00:06:55.240>provide <00:06:55.520>those <00:06:55.800>proof <00:06:56.080>of <00:06:56.360>concepts, <00:06:56.640>uh,

110
00:06:57.240 --> 00:07:00.280
<00:06:57.240>that <00:06:57.367>you <00:06:57.494>can <00:06:57.621>also <00:06:57.749>have <00:06:57.876>a <00:06:58.003>look <00:06:58.130>and <00:06:58.258>understand <00:06:58.385>a <00:06:58.512>bit <00:06:58.640>more,

111
00:07:00.280 --> 00:07:04.240
<00:07:00.280>getting <00:07:00.387>a <00:07:00.495>little <00:07:00.603>bit <00:07:00.710>more, <00:07:00.818>uh, <00:07:00.926>context. <00:07:01.033>Um, <00:07:01.141>and <00:07:01.249>yeah, <00:07:01.356>you <00:07:01.464>can <00:07:01.572>see <00:07:01.679>the,

112
00:07:04.240 --> 00:07:07.960
<00:07:04.240>the <00:07:04.340>batch <00:07:04.440>terminal <00:07:04.540>at <00:07:04.640>the, <00:07:04.740>uh, <00:07:04.840>at <00:07:04.940>the <00:07:05.040>bottom <00:07:05.140>of <00:07:05.240>this, <00:07:05.340>uh, <00:07:05.440>screenshot <00:07:05.540>and <00:07:05.640>the,

113
00:07:07.960 --> 00:07:10.160
<00:07:07.960>that <00:07:08.193>security <00:07:08.426>researcher <00:07:08.659>actually <00:07:08.893>managed <00:07:09.126>to, <00:07:09.359>uh,

114
00:07:10.160 --> 00:07:12.920
<00:07:10.160>to <00:07:10.335>perform <00:07:10.510>Pat <00:07:10.685>Reversal <00:07:10.860>using <00:07:11.035>that, <00:07:11.210>that <00:07:11.385>payload <00:07:11.560>loads.

115
00:07:15.070 --> 00:07:19.290
<00:07:15.070>So <00:07:15.152>file <00:07:15.234>path <00:07:15.317>a <00:07:15.399>p <00:07:15.481>i, <00:07:15.564>anyone <00:07:15.646>who <00:07:15.728>here <00:07:15.811>is <00:07:15.893>familiar <00:07:15.975>with, <00:07:16.058>uh, <00:07:16.140>the <00:07:16.222>path <00:07:16.305>a <00:07:16.387>p <00:07:16.469>i.

116
00:07:22.910 --> 00:07:27.350
<00:07:22.910>Okay, <00:07:23.050>great. <00:07:23.190>We <00:07:23.330>have <00:07:23.470>a <00:07:23.610>few. <00:07:23.750>So <00:07:23.890>just <00:07:24.030>to <00:07:24.170>simplify <00:07:24.310>it.

117
00:07:27.370 --> 00:07:32.030
<00:07:27.370>So <00:07:27.486>the <00:07:27.603>path <00:07:27.720>do <00:07:27.836>giant, <00:07:27.953>uh, <00:07:28.070>function <00:07:28.186>is <00:07:28.303>used <00:07:28.420>to <00:07:28.536>concatenate <00:07:28.653>path <00:07:28.770>segments.

118
00:07:32.730 --> 00:07:36.550
<00:07:32.730>The <00:07:32.870>path <00:07:33.010>dot <00:07:33.150>results <00:07:33.290>function <00:07:33.430>is <00:07:33.570>used <00:07:33.710>to <00:07:33.850>make <00:07:33.990>absolute <00:07:34.130>path,

119
00:07:37.090 --> 00:07:41.670
<00:07:37.090>and <00:07:37.197>the <00:07:37.305>pet <00:07:37.413>normalize <00:07:37.520>is <00:07:37.628>used <00:07:37.736>to <00:07:37.843>clean <00:07:37.951>and <00:07:38.059>sterilize <00:07:38.166>paths <00:07:38.274>by <00:07:38.382>removing <00:07:38.490>the.dot

120
00:07:41.670 --> 00:07:46.230
<00:07:41.670>segments. <00:07:41.870>So, <00:07:42.070>we'll, <00:07:42.270>we'll <00:07:42.470>see <00:07:42.670>a <00:07:42.870>few <00:07:43.070>examples,

121
00:07:46.230 --> 00:07:49.950
<00:07:46.230>and <00:07:46.323>first <00:07:46.416>we'll <00:07:46.510>see <00:07:46.603>how, <00:07:46.696>uh, <00:07:46.790>why <00:07:46.883>is <00:07:46.976>path <00:07:47.070>vessel <00:07:47.163>is <00:07:47.256>happening <00:07:47.350>to, <00:07:47.443>to <00:07:47.536>begin <00:07:47.630>with.

122
00:07:51.000 --> 00:07:53.150
<00:07:51.000>We'll <00:07:51.200>see <00:07:51.400>also <00:07:51.600>how <00:07:51.800>to <00:07:52.000>avoid <00:07:52.200>it, <00:07:52.400>uh,

123
00:07:53.310 --> 00:07:57.550
<00:07:53.310>'cause <00:07:53.417>we <00:07:53.525>don't <00:07:53.633>want <00:07:53.740>to <00:07:53.848>have <00:07:53.956>veal <00:07:54.063>in <00:07:54.171>our <00:07:54.279>code <00:07:54.386>base. <00:07:54.494>And <00:07:54.602>also, <00:07:54.710>uh,

124
00:07:57.940 --> 00:08:00.750
<00:07:57.940>what <00:07:58.080>are <00:07:58.219>some <00:07:58.360>of <00:07:58.500>the <00:07:58.640>secure <00:07:58.780>practice <00:07:58.920>and <00:07:59.060>actually <00:07:59.200>the, <00:07:59.340>uh,

125
00:08:00.750 --> 00:08:04.870
<00:08:00.750>correct <00:08:00.850>order <00:08:00.950>of <00:08:01.050>those, <00:08:01.150>uh, <00:08:01.250>file <00:08:01.350>a <00:08:01.450>p <00:08:01.550>i, <00:08:01.650>uh, <00:08:01.750>that <00:08:01.850>you <00:08:01.950>need <00:08:02.050>to <00:08:02.150>implement.

126
00:08:06.120 --> 00:08:08.460
<00:08:06.120>So <00:08:06.320>let's <00:08:06.520>an <00:08:06.720>example <00:08:06.920>with, <00:08:07.120>uh, <00:08:07.320>the, <00:08:07.520>um,

127
00:08:08.640 --> 00:08:11.300
<00:08:08.640>the <00:08:08.840>veal <00:08:09.039>in <00:08:09.240>an <00:08:09.440>N <00:08:09.640>P <00:08:09.840>M <00:08:10.039>package.

128
00:08:14.170 --> 00:08:17.270
<00:08:14.170>So <00:08:14.345>this <00:08:14.520>is <00:08:14.695>an <00:08:14.870>existing, <00:08:15.045>uh, <00:08:15.220>package <00:08:15.395>called <00:08:15.570>st.

129
00:08:17.780 --> 00:08:19.750
<00:08:17.780>This <00:08:18.059>was <00:08:18.340>affected <00:08:18.619>by <00:08:18.900>path <00:08:19.179>reversal.

130
00:08:20.170 --> 00:08:24.230
<00:08:20.170>And <00:08:20.277>you <00:08:20.385>can <00:08:20.493>see <00:08:20.600>it's <00:08:20.708>eloquently <00:08:20.816>described <00:08:20.923>itself <00:08:21.031>as <00:08:21.139>a <00:08:21.246>module <00:08:21.354>that <00:08:21.462>serves <00:08:21.570>static

131
00:08:24.230 --> 00:08:28.350
<00:08:24.230>files. <00:08:24.330>So <00:08:24.430>it's, <00:08:24.530>it's <00:08:24.630>been <00:08:24.730>quite <00:08:24.830>popular. <00:08:24.930>Um, <00:08:25.030>you <00:08:25.130>can <00:08:25.230>see <00:08:25.330>it <00:08:25.430>on <00:08:25.530>the, <00:08:25.630>uh,

132
00:08:28.350 --> 00:08:32.430
<00:08:28.350>this <00:08:28.490>chart <00:08:28.630>very <00:08:28.770>well <00:08:28.910>on <00:08:29.050>the <00:08:29.190>JavaScript <00:08:29.330>ecosystem. <00:08:29.470>I <00:08:29.610>have <00:08:29.750>a,

133
00:08:32.590 --> 00:08:34.350
<00:08:32.590>a <00:08:32.823>bunch <00:08:33.056>of <00:08:33.290>downloads, <00:08:33.523>uh, <00:08:33.756>per <00:08:33.990>week.

134
00:08:35.130 --> 00:08:38.750
<00:08:35.130>And <00:08:35.304>ASTI <00:08:35.480>normalize <00:08:35.655>the <00:08:35.830>path <00:08:36.005>to <00:08:36.179>prevent <00:08:36.355>reversal, <00:08:36.530>uh,

135
00:08:38.750 --> 00:08:42.830
<00:08:38.750>issues <00:08:38.850>like <00:08:38.950>the <00:08:39.049>DO <00:08:39.150>dot <00:08:39.250>slash <00:08:39.350>type <00:08:39.450>of <00:08:39.549>attack <00:08:39.650>by <00:08:39.750>resolving <00:08:39.850>the <00:08:39.950>dot <00:08:40.049>dots, <00:08:40.150>uh,

136
00:08:42.830 --> 00:08:43.663
<00:08:42.830>slash <00:08:43.579>segments.

137
00:08:44.090 --> 00:08:48.950
<00:08:44.090>But <00:08:44.217>it <00:08:44.344>doesn't <00:08:44.471>do <00:08:44.599>an <00:08:44.726>extensive <00:08:44.853>sensation <00:08:44.980>by <00:08:45.108>defaults <00:08:45.235>by <00:08:45.362>adding, <00:08:45.490>uh,

138
00:08:48.950 --> 00:08:52.790
<00:08:48.950>additional <00:08:49.105>checks <00:08:49.261>that <00:08:49.416>may <00:08:49.572>be <00:08:49.727>actually <00:08:49.883>needed <00:08:50.038>for <00:08:50.194>entrusted <00:08:50.350>inputs.

139
00:08:54.630 --> 00:08:57.370
<00:08:54.630>So <00:08:54.770>here, <00:08:54.910>let's <00:08:55.050>see <00:08:55.189>an <00:08:55.330>example <00:08:55.470>of <00:08:55.610>what <00:08:55.750>it <00:08:55.890>could <00:08:56.030>be.

140
00:08:57.590 --> 00:09:00.850
<00:08:57.590>So <00:08:57.706>here <00:08:57.823>you <00:08:57.940>can <00:08:58.056>see <00:08:58.173>that <00:08:58.290>you're <00:08:58.406>requiring <00:08:58.523>the, <00:08:58.640>uh, <00:08:58.756>the <00:08:58.873>ST <00:08:58.990>package.

141
00:09:01.150 --> 00:09:05.690
<00:09:01.150>You're <00:09:01.257>just <00:09:01.365>like <00:09:01.473>using <00:09:01.580>it, <00:09:01.688>uh, <00:09:01.796>for <00:09:01.903>the, <00:09:02.011>uh, <00:09:02.119>the <00:09:02.226>path <00:09:02.334>public. <00:09:02.442>So <00:09:02.550>you're,

142
00:09:05.690 --> 00:09:08.610
<00:09:05.690>you're <00:09:05.830>requiring <00:09:05.970>the <00:09:06.110>SD <00:09:06.250>module, <00:09:06.390>or <00:09:06.530>you're <00:09:06.670>registering <00:09:06.810>the <00:09:06.950>s <00:09:07.090>uh,

143
00:09:08.830 --> 00:09:12.410
<00:09:08.830>st <00:09:08.930>middle <00:09:09.030>well <00:09:09.130>to <00:09:09.230>serve <00:09:09.330>the, <00:09:09.430>uh, <00:09:09.530>the <00:09:09.630>public <00:09:09.730>directory. <00:09:09.830>And <00:09:09.930>then <00:09:10.030>you <00:09:10.130>create, <00:09:10.230>uh,

144
00:09:12.630 --> 00:09:15.450
<00:09:12.630>HT <00:09:12.785>P <00:09:12.941>server <00:09:13.096>to <00:09:13.252>attach <00:09:13.407>the <00:09:13.563>app <00:09:13.718>and <00:09:13.874>start <00:09:14.030>listening.

145
00:09:15.710 --> 00:09:19.970
<00:09:15.710>So <00:09:15.817>this <00:09:15.925>will <00:09:16.033>expose <00:09:16.140>the <00:09:16.248>slash <00:09:16.356>public <00:09:16.463>folder <00:09:16.571>in <00:09:16.679>the <00:09:16.786>application <00:09:16.894>using <00:09:17.002>the <00:09:17.110>SC

146
00:09:19.970 --> 00:09:20.970
<00:09:19.970>virtual <00:09:20.420>file <00:09:20.870>system.

147
00:09:23.520 --> 00:09:27.460
<00:09:23.520>And <00:09:23.647>now <00:09:23.774>if <00:09:23.901>we <00:09:24.029>do <00:09:24.156>this <00:09:24.283>curl <00:09:24.410>command, <00:09:24.538>so <00:09:24.665>we're <00:09:24.792>running, <00:09:24.920>uh,

148
00:09:27.460 --> 00:09:32.060
<00:09:27.460>curl <00:09:27.553>with <00:09:27.646>path <00:09:27.740>edit, <00:09:27.833>'cause <00:09:27.926>we <00:09:28.020>don't <00:09:28.113>want <00:09:28.206>to, <00:09:28.300>uh, <00:09:28.393>journalize <00:09:28.486>it <00:09:28.580>to <00:09:28.673>this <00:09:28.766>u <00:09:28.860>l.

149
00:09:32.560 --> 00:09:36.260
<00:09:32.560>So <00:09:32.676>this <00:09:32.793>attempts <00:09:32.910>to <00:09:33.026>break <00:09:33.143>out <00:09:33.260>of <00:09:33.376>the, <00:09:33.493>um, <00:09:33.609>the <00:09:33.726>slash <00:09:33.843>public, <00:09:33.959>uh,

150
00:09:36.440 --> 00:09:40.060
<00:09:36.440>and <00:09:36.547>trying <00:09:36.655>to <00:09:36.763>use <00:09:36.870>the <00:09:36.978>dot <00:09:37.086>slash <00:09:37.193>to <00:09:37.301>actually <00:09:37.409>access <00:09:37.516>the <00:09:37.624>package. <00:09:37.732>Do <00:09:37.840>Jason,

151
00:09:40.500 --> 00:09:42.740
<00:09:40.500>'cause <00:09:40.616>again, <00:09:40.733>we <00:09:40.850>want <00:09:40.966>to <00:09:41.083>know <00:09:41.200>all <00:09:41.316>the, <00:09:41.433>the <00:09:41.550>different <00:09:41.666>versions <00:09:41.783>of <00:09:41.900>the,

152
00:09:42.740 --> 00:09:44.820
<00:09:42.740>the <00:09:42.940>packages <00:09:43.140>that <00:09:43.340>we <00:09:43.540>have <00:09:43.740>as <00:09:43.940>an <00:09:44.140>attacker.

153
00:09:46.390 --> 00:09:51.210
<00:09:46.390>But <00:09:46.497>actually <00:09:46.605>what <00:09:46.713>happened <00:09:46.820>with <00:09:46.928>this <00:09:47.036>one, <00:09:47.143>we <00:09:47.251>can't <00:09:47.359>get <00:09:47.466>it. <00:09:47.574>It <00:09:47.682>doesn't <00:09:47.790>work,

154
00:09:51.260 --> 00:09:54.450
<00:09:51.260>which <00:09:51.400>is <00:09:51.540>good <00:09:51.680>news. <00:09:51.819>'cause <00:09:51.960>we, <00:09:52.100>we, <00:09:52.240>that's <00:09:52.380>the <00:09:52.520>expected <00:09:52.660>behavior.

155
00:09:54.510 --> 00:09:57.730
<00:09:54.510>We <00:09:54.650>don't <00:09:54.790>want <00:09:54.930>an <00:09:55.069>attacker <00:09:55.210>to <00:09:55.350>actually <00:09:55.490>have <00:09:55.630>access <00:09:55.770>to <00:09:55.910>it.

156
00:10:01.560 --> 00:10:06.460
<00:10:01.560>So <00:10:01.676>here <00:10:01.793>I've <00:10:01.910>actually, <00:10:02.026>uh, <00:10:02.143>took <00:10:02.260>some <00:10:02.376>of <00:10:02.493>the, <00:10:02.609>uh, <00:10:02.726>the <00:10:02.843>st <00:10:02.959>uh,

157
00:10:06.460 --> 00:10:11.460
<00:10:06.460>things, <00:10:06.560>the <00:10:06.660>st <00:10:06.760>um, <00:10:06.860>codes, <00:10:06.960>and <00:10:07.060>we <00:10:07.160>can <00:10:07.260>go <00:10:07.360>through <00:10:07.460>it <00:10:07.560>and <00:10:07.660>simulate <00:10:07.760>kind <00:10:07.860>of,

158
00:10:11.680 --> 00:10:16.220
<00:10:11.680>uh, <00:10:11.780>debugging <00:10:11.880>and <00:10:11.979>just <00:10:12.079>to <00:10:12.180>go, <00:10:12.280>um, <00:10:12.380>line <00:10:12.479>by <00:10:12.579>line <00:10:12.680>and <00:10:12.780>see <00:10:12.880>how <00:10:12.979>it <00:10:13.079>actually,

159
00:10:16.560 --> 00:10:20.660
<00:10:16.560>uh, <00:10:16.699>do <00:10:16.839>this, <00:10:16.979>uh, <00:10:17.119>sensation. <00:10:17.260>So <00:10:17.400>first <00:10:17.540>we <00:10:17.680>have <00:10:17.819>the, <00:10:17.959>uh,

160
00:10:20.960 --> 00:10:23.900
<00:10:20.960>the <00:10:21.115>GATT <00:10:21.271>path <00:10:21.426>function <00:10:21.582>that <00:10:21.737>is <00:10:21.893>expecting <00:10:22.048>a <00:10:22.204>u <00:10:22.360>l.

161
00:10:24.040 --> 00:10:28.380
<00:10:24.040>So <00:10:24.180>here <00:10:24.319>we <00:10:24.459>have <00:10:24.599>public <00:10:24.740>slash <00:10:24.880>dot <00:10:25.020>slash <00:10:25.160>package <00:10:25.300>json. <00:10:25.439>And

162
00:10:30.700 --> 00:10:34.980
<00:10:30.700>then <00:10:30.787>it <00:10:30.875>begins <00:10:30.962>by <00:10:31.050>using <00:10:31.137>the <00:10:31.225>built-in <00:10:31.312>u <00:10:31.400>l <00:10:31.487>core <00:10:31.575>modules <00:10:31.662>to <00:10:31.750>pour <00:10:31.837>out <00:10:31.925>the <00:10:32.012>URL <00:10:32.100>for

163
00:10:34.980 --> 00:10:38.660
<00:10:34.980>giving, <00:10:35.096>giving <00:10:35.213>patent <00:10:35.330>name, <00:10:35.446>which <00:10:35.563>will <00:10:35.680>re, <00:10:35.796>uh, <00:10:35.913>return <00:10:36.030>the <00:10:36.146>results <00:10:36.263>of, <00:10:36.380>uh,

164
00:10:38.660 --> 00:10:42.300
<00:10:38.660>public <00:10:38.800>slash <00:10:38.939>do <00:10:39.079>slash <00:10:39.219>package, <00:10:39.360>do <00:10:39.500>json <00:10:39.640>and <00:10:39.780>throw <00:10:39.920>it <00:10:40.060>down.

165
00:10:42.510 --> 00:10:46.540
<00:10:42.510>We'll <00:10:42.610>do <00:10:42.710>some <00:10:42.810>extra <00:10:42.910>regular <00:10:43.010>expression <00:10:43.110>work <00:10:43.210>just <00:10:43.310>to <00:10:43.410>filter <00:10:43.510>out <00:10:43.610>the <00:10:43.710>rogue <00:10:43.810>u <00:10:43.910>l

166
00:10:46.540 --> 00:10:50.860
<00:10:46.540>path <00:10:46.640>slashes <00:10:46.740>and <00:10:46.839>presumably <00:10:46.939>also <00:10:47.040>that <00:10:47.140>the <00:10:47.240>user <00:10:47.339>won't <00:10:47.439>be <00:10:47.540>able <00:10:47.640>to, <00:10:47.740>to <00:10:47.839>escape <00:10:47.939>them.

167
00:10:53.850 --> 00:10:57.590
<00:10:53.850>And <00:10:53.950>then <00:10:54.050>this <00:10:54.150>patent <00:10:54.250>name <00:10:54.350>value <00:10:54.450>that <00:10:54.550>is <00:10:54.650>handed <00:10:54.750>off <00:10:54.850>to, <00:10:54.950>uh, <00:10:55.050>the <00:10:55.150>core, <00:10:55.250>the,

168
00:10:57.610 --> 00:11:01.790
<00:10:57.610>the <00:10:57.737>path <00:10:57.864>per <00:10:57.991>module, <00:10:58.119>which <00:10:58.246>will <00:10:58.373>run <00:10:58.500>the, <00:10:58.628>uh, <00:10:58.755>normalized <00:10:58.882>function <00:10:59.010>here.

169
00:11:02.290 --> 00:11:06.150
<00:11:02.290>And <00:11:02.445>then <00:11:02.601>the <00:11:02.756>normalized <00:11:02.912>function <00:11:03.067>is <00:11:03.223>basically <00:11:03.378>evaluating, <00:11:03.534>uh, <00:11:03.689>this,

170
00:11:06.610 --> 00:11:10.990
<00:11:06.610>and <00:11:06.717>it <00:11:06.825>will <00:11:06.933>remove <00:11:07.040>the, <00:11:07.148>uh, <00:11:07.256>dot <00:11:07.363>dot <00:11:07.471>slash <00:11:07.579>So <00:11:07.686>you <00:11:07.794>have <00:11:07.902>this <00:11:08.010>now.

171
00:11:14.020 --> 00:11:18.720
<00:11:14.020>And <00:11:14.160>then <00:11:14.300>when <00:11:14.439>I <00:11:14.579>go <00:11:14.720>to <00:11:14.860>this, <00:11:15.000>um, <00:11:15.140>this <00:11:15.280>if <00:11:15.420>statement,

172
00:11:18.770 --> 00:11:21.840
<00:11:18.770>it'll <00:11:18.925>check <00:11:19.081>if <00:11:19.236>it's <00:11:19.392>actually <00:11:19.547>starting <00:11:19.703>with <00:11:19.858>public. <00:11:20.014>It <00:11:20.170>doesn't,

173
00:11:21.960 --> 00:11:24.800
<00:11:21.960>'cause <00:11:22.060>we <00:11:22.160>only <00:11:22.260>have <00:11:22.360>the <00:11:22.460>slash <00:11:22.560>package <00:11:22.660>of <00:11:22.760>days, <00:11:22.860>so <00:11:22.960>it's <00:11:23.060>not <00:11:23.160>gonna <00:11:23.260>serve <00:11:23.360>it.

174
00:11:24.800 --> 00:11:27.240
<00:11:24.800>You're <00:11:24.907>gonna <00:11:25.015>have <00:11:25.123>a <00:11:25.230>4 <00:11:25.338>0 <00:11:25.446>4, <00:11:25.553>that's <00:11:25.661>why <00:11:25.769>we <00:11:25.876>couldn't <00:11:25.984>actually <00:11:26.092>access <00:11:26.199>it,

175
00:11:27.650 --> 00:11:30.160
<00:11:27.650>which <00:11:27.850>is <00:11:28.050>good <00:11:28.250>'cause <00:11:28.449>that's <00:11:28.650>the <00:11:28.850>expected <00:11:29.050>behavior.

176
00:11:32.570 --> 00:11:34.190
<00:11:32.570>So <00:11:32.850>let's <00:11:33.130>see, <00:11:33.410>as <00:11:33.690>a <00:11:33.970>hacker,

177
00:11:34.290 --> 00:11:39.030
<00:11:34.290>we <00:11:34.406>could <00:11:34.523>potentially <00:11:34.640>bypass <00:11:34.756>this <00:11:34.873>and <00:11:34.990>we <00:11:35.106>can <00:11:35.223>actually <00:11:35.339>use <00:11:35.456>the <00:11:35.573>u <00:11:35.689>l

178
00:11:39.030 --> 00:11:39.810
<00:11:39.030>encoding <00:11:39.381>for <00:11:39.732>this.

179
00:11:39.810 --> 00:11:44.030
<00:11:39.810>So <00:11:39.910>instead <00:11:40.010>of <00:11:40.109>having <00:11:40.209>the <00:11:40.310>dot <00:11:40.410>slash <00:11:40.510>we'll <00:11:40.609>encode <00:11:40.709>the <00:11:40.810>dots <00:11:40.910>with <00:11:41.010>percent <00:11:41.109>to <00:11:41.209>E.

180
00:11:44.930 --> 00:11:49.870
<00:11:44.930>So <00:11:45.017>basically <00:11:45.104>uur <00:11:45.192>L <00:11:45.280>encoding <00:11:45.367>is <00:11:45.454>the <00:11:45.542>process <00:11:45.630>of <00:11:45.717>encoding <00:11:45.805>information <00:11:45.892>in <00:11:45.979>A <00:11:46.067>U <00:11:46.155>R <00:11:46.242>L <00:11:46.329>by

181
00:11:49.870 --> 00:11:54.230
<00:11:49.870>replacing <00:11:50.010>characters <00:11:50.150>with <00:11:50.290>a <00:11:50.430>percent, <00:11:50.570>followed <00:11:50.710>by <00:11:50.850>their <00:11:50.990>ex <00:11:51.130>decimal <00:11:51.270>value.

182
00:11:54.730 --> 00:11:59.460
<00:11:54.730>And <00:11:54.870>here <00:11:55.010>usually <00:11:55.150>if <00:11:55.290>you <00:11:55.430>want <00:11:55.570>to, <00:11:55.710>uh, <00:11:55.850>to <00:11:55.990>uncode, <00:11:56.130>uh,

183
00:11:59.460 --> 00:12:02.780
<00:11:59.460>some <00:11:59.600>of, <00:11:59.740>um, <00:11:59.880>certain <00:12:00.020>characters <00:12:00.160>or <00:12:00.300>unsafe <00:12:00.440>characters, <00:12:00.580>you <00:12:00.720>reduce <00:12:00.860>that,

184
00:12:02.780 --> 00:12:07.360
<00:12:02.780>that <00:12:02.980>methodology. <00:12:03.180>So <00:12:03.380>here, <00:12:03.579>back <00:12:03.780>to <00:12:03.980>the, <00:12:04.180>uh,

185
00:12:07.380 --> 00:12:11.000
<00:12:07.380>the <00:12:07.487>code. <00:12:07.595>And <00:12:07.703>let's <00:12:07.810>try <00:12:07.918>with <00:12:08.026>this <00:12:08.133>new <00:12:08.241>method <00:12:08.349>by <00:12:08.456>encoding <00:12:08.564>it. <00:12:08.672>So <00:12:08.780>we,

186
00:12:11.100 --> 00:12:14.400
<00:12:11.100>we <00:12:11.227>have <00:12:11.354>the <00:12:11.481>same <00:12:11.609>path, <00:12:11.736>but <00:12:11.863>we've <00:12:11.990>replaced <00:12:12.118>the <00:12:12.245>dot <00:12:12.372>dots, <00:12:12.500>uh,

187
00:12:14.400 --> 00:12:19.130
<00:12:14.400>slash <00:12:14.574>segment <00:12:14.750>with <00:12:14.925>the <00:12:15.100>percent <00:12:15.275>two <00:12:15.449>E. <00:12:15.625>And <00:12:15.800>here,

188
00:12:21.950 --> 00:12:25.310
<00:12:21.950>Actually, <00:12:22.057>if <00:12:22.165>we're <00:12:22.273>going <00:12:22.380>back <00:12:22.488>to <00:12:22.596>the, <00:12:22.703>uh, <00:12:22.811>the <00:12:22.919>normalize, <00:12:23.026>it's <00:12:23.134>just <00:12:23.242>passing <00:12:23.350>it

189
00:12:27.110 --> 00:12:29.130
<00:12:27.110>and <00:12:27.310>you <00:12:27.510>can <00:12:27.710>see <00:12:27.910>nothing <00:12:28.110>is <00:12:28.310>actually <00:12:28.510>happening.

190
00:12:29.160 --> 00:12:33.850
<00:12:29.160>It's <00:12:29.276>not <00:12:29.393>gonna <00:12:29.510>remove <00:12:29.626>the <00:12:29.743>percent <00:12:29.860>two <00:12:29.976>'cause <00:12:30.093>we've <00:12:30.209>actually <00:12:30.326>encoded. <00:12:30.443>So <00:12:30.560>for,

191
00:12:34.070 --> 00:12:36.890
<00:12:34.070>uh, <00:12:34.225>for <00:12:34.381>the, <00:12:34.536>uh, <00:12:34.692>this <00:12:34.847>function <00:12:35.003>is <00:12:35.158>the, <00:12:35.314>the <00:12:35.470>usual.

192
00:12:37.830 --> 00:12:42.330
<00:12:37.830>And <00:12:37.957>then <00:12:38.084>we'll <00:12:38.211>actually <00:12:38.339>pass <00:12:38.466>the, <00:12:38.593>uh, <00:12:38.720>the <00:12:38.848>IF <00:12:38.975>statements, <00:12:39.102>'cause <00:12:39.230>it's,

193
00:12:42.330 --> 00:12:44.210
<00:12:42.330>it's <00:12:42.530>starting <00:12:42.730>with <00:12:42.930>the, <00:12:43.130>uh, <00:12:43.330>the <00:12:43.530>slash <00:12:43.730>public.

194
00:12:44.630 --> 00:12:47.330
<00:12:44.630>And <00:12:44.785>then <00:12:44.941>you'll <00:12:45.096>get <00:12:45.252>the <00:12:45.407>coded <00:12:45.563>with <00:12:45.718>this <00:12:45.874>function, <00:12:46.030>the,

195
00:12:47.390 --> 00:12:50.150
<00:12:47.390>the <00:12:47.545>code <00:12:47.701>U <00:12:47.856>r <00:12:48.012>L <00:12:48.167>components. <00:12:48.323>And <00:12:48.478>you'll <00:12:48.634>have <00:12:48.790>this,

196
00:12:50.450 --> 00:12:54.750
<00:12:50.450>and <00:12:50.557>this <00:12:50.665>is <00:12:50.773>when <00:12:50.880>it <00:12:50.988>happens <00:12:51.096>that <00:12:51.203>you <00:12:51.311>actually <00:12:51.419>manage <00:12:51.526>to, <00:12:51.634>to <00:12:51.742>bypass, <00:12:51.850>uh,

197
00:12:54.780 --> 00:12:58.510
<00:12:54.780>this <00:12:54.907>and, <00:12:55.034>um, <00:12:55.161>do <00:12:55.289>the, <00:12:55.416>uh, <00:12:55.543>the <00:12:55.670>path <00:12:55.798>reversal <00:12:55.925>in <00:12:56.052>a <00:12:56.180>sense.

198
00:13:00.970 --> 00:13:03.790
<00:13:00.970>So <00:13:01.086>here <00:13:01.203>you'll <00:13:01.320>see <00:13:01.436>when <00:13:01.553>you <00:13:01.670>do <00:13:01.786>the, <00:13:01.903>uh, <00:13:02.020>the <00:13:02.136>path <00:13:02.253>do <00:13:02.370>join,

199
00:13:03.790 --> 00:13:07.030
<00:13:03.790>this <00:13:03.906>is <00:13:04.023>what <00:13:04.140>you <00:13:04.256>have <00:13:04.373>public, <00:13:04.490>uh, <00:13:04.606>slash <00:13:04.723>dot <00:13:04.839>slash <00:13:04.956>package <00:13:05.073>do <00:13:05.189>Jason,

200
00:13:07.090 --> 00:13:10.870
<00:13:07.090>and <00:13:07.217>then <00:13:07.344>the <00:13:07.471>attacker <00:13:07.599>will <00:13:07.726>have <00:13:07.853>access <00:13:07.980>to <00:13:08.108>the <00:13:08.235>package, <00:13:08.362>do <00:13:08.490>json,

201
00:13:14.680 --> 00:13:17.950
<00:13:14.680>And <00:13:14.835>now <00:13:14.991>this <00:13:15.146>is <00:13:15.302>already <00:13:15.457>serving <00:13:15.613>the, <00:13:15.768>uh, <00:13:15.924>the <00:13:16.079>file.

202
00:13:17.950 --> 00:13:21.070
<00:13:17.950>And <00:13:18.057>then <00:13:18.165>we <00:13:18.273>can <00:13:18.380>have <00:13:18.488>access <00:13:18.596>to, <00:13:18.703>uh, <00:13:18.811>to <00:13:18.919>it, <00:13:19.026>which <00:13:19.134>is <00:13:19.242>not <00:13:19.350>good.

203
00:13:22.800 --> 00:13:26.500
<00:13:22.800>So <00:13:22.887>if <00:13:22.974>I <00:13:23.062>send <00:13:23.150>a <00:13:23.237>request <00:13:23.324>with <00:13:23.412>the, <00:13:23.500>uh, <00:13:23.587>the <00:13:23.675>percent, <00:13:23.762>two <00:13:23.849>and <00:13:23.937>percent <00:13:24.025>two <00:13:24.112>as <00:13:24.199>a,

204
00:13:26.500 --> 00:13:28.620
<00:13:26.500>as <00:13:26.700>a <00:13:26.900>pet <00:13:27.100>reversal <00:13:27.300>to <00:13:27.500>a <00:13:27.700>vulnerable, <00:13:27.900>um,

205
00:13:29.010 --> 00:13:33.900
<00:13:29.010>express <00:13:29.117>web <00:13:29.225>application <00:13:29.333>that <00:13:29.440>run <00:13:29.548>the <00:13:29.656>ST <00:13:29.763>package <00:13:29.871>as <00:13:29.979>the <00:13:30.086>middle <00:13:30.194>wire <00:13:30.302>in <00:13:30.410>that

206
00:13:34.100 --> 00:13:34.610
<00:13:34.100>specific <00:13:34.559>version,

207
00:13:34.610 --> 00:13:38.540
<00:13:34.610>they <00:13:34.710>would <00:13:34.810>actually <00:13:34.910>be <00:13:35.010>able <00:13:35.110>to <00:13:35.210>access <00:13:35.310>any <00:13:35.410>files <00:13:35.510>that <00:13:35.610>we <00:13:35.710>know <00:13:35.810>their <00:13:35.910>path <00:13:36.010>to

208
00:13:38.540 --> 00:13:41.940
<00:13:38.540>exists <00:13:38.647>on <00:13:38.755>the <00:13:38.863>server. <00:13:38.970>And <00:13:39.078>it's <00:13:39.186>as <00:13:39.293>simple <00:13:39.401>as <00:13:39.509>that. <00:13:39.616>This <00:13:39.724>attack <00:13:39.832>is <00:13:39.939>quite,

209
00:13:41.960 --> 00:13:43.740
<00:13:41.960>is <00:13:42.193>quite <00:13:42.426>simple <00:13:42.660>to, <00:13:42.893>uh, <00:13:43.126>to <00:13:43.360>process.

210
00:13:46.890 --> 00:13:49.470
<00:13:46.890>But <00:13:47.045>you <00:13:47.201>use <00:13:47.356>the, <00:13:47.512>the <00:13:47.667>team <00:13:47.823>behind <00:13:47.978>maintaining <00:13:48.134>the, <00:13:48.290>uh,

211
00:13:49.470 --> 00:13:52.070
<00:13:49.470>the <00:13:49.625>SD <00:13:49.781>package <00:13:49.936>actually <00:13:50.092>managed <00:13:50.247>to, <00:13:50.403>to <00:13:50.558>push <00:13:50.714>a <00:13:50.870>fix.

212
00:13:52.170 --> 00:13:54.470
<00:13:52.170>And <00:13:52.310>you <00:13:52.449>can <00:13:52.589>see <00:13:52.729>the <00:13:52.870>difference. <00:13:53.010>They <00:13:53.150>actually <00:13:53.290>changed <00:13:53.430>the, <00:13:53.569>uh,

213
00:13:54.730 --> 00:13:57.390
<00:13:54.730>the <00:13:54.930>order <00:13:55.130>for <00:13:55.330>the, <00:13:55.530>uh, <00:13:55.730>the <00:13:55.930>normalized <00:13:56.130>function.

214
00:13:57.890 --> 00:14:02.390
<00:13:57.890>And <00:13:57.990>you <00:13:58.090>can <00:13:58.189>see <00:13:58.290>that <00:13:58.390>they <00:13:58.490>actually <00:13:58.590>cover <00:13:58.689>a <00:13:58.790>few <00:13:58.890>use <00:13:58.990>cases <00:13:59.090>to <00:13:59.189>actually, <00:13:59.290>um,

215
00:14:02.890 --> 00:14:05.030
<00:14:02.890>decode <00:14:03.045>it. <00:14:03.201>The, <00:14:03.356>uh, <00:14:03.512>so <00:14:03.667>you <00:14:03.823>have <00:14:03.978>the <00:14:04.134>percent <00:14:04.290>two,

216
00:14:05.030 --> 00:14:07.910
<00:14:05.030>you <00:14:05.146>can <00:14:05.263>see <00:14:05.380>it <00:14:05.496>is <00:14:05.613>replaced <00:14:05.730>by <00:14:05.846>the <00:14:05.963>dots <00:14:06.079>and <00:14:06.196>then <00:14:06.313>it's <00:14:06.430>normalizing.

217
00:14:07.930 --> 00:14:12.070
<00:14:07.930>So <00:14:08.069>which <00:14:08.209>will <00:14:08.349>remove <00:14:08.489>the, <00:14:08.630>uh, <00:14:08.770>percent, <00:14:08.910>the, <00:14:09.050>um, <00:14:09.189>the <00:14:09.329>slash

218
00:14:14.610 --> 00:14:16.750
<00:14:14.610>So <00:14:14.785>it <00:14:14.960>is <00:14:15.135>important <00:14:15.310>to <00:14:15.485>actually <00:14:15.660>get <00:14:15.835>the, <00:14:16.010>uh,

219
00:14:16.890 --> 00:14:18.910
<00:14:16.890>the <00:14:17.045>false <00:14:17.201>path <00:14:17.356>a <00:14:17.512>p <00:14:17.667>i <00:14:17.823>in <00:14:17.978>the <00:14:18.134>right <00:14:18.290>order.

220
00:14:19.090 --> 00:14:23.830
<00:14:19.090>So <00:14:19.172>at <00:14:19.254>first <00:14:19.337>you'll <00:14:19.419>need <00:14:19.501>to <00:14:19.584>use <00:14:19.666>the <00:14:19.748>decode <00:14:19.831>u <00:14:19.913>i <00:14:19.995>component <00:14:20.078>to <00:14:20.160>make <00:14:20.242>sure <00:14:20.325>that <00:14:20.407>if <00:14:20.490>you

221
00:14:23.860 --> 00:14:27.870
<00:14:23.860>have <00:14:23.960>an <00:14:24.060>instance <00:14:24.160>of <00:14:24.260>the <00:14:24.360>percentage <00:14:24.460>to <00:14:24.560>make <00:14:24.660>sure <00:14:24.760>that <00:14:24.860>you're <00:14:24.960>decoded <00:14:25.060>this <00:14:25.160>part <00:14:25.260>of

222
00:14:27.870 --> 00:14:30.030
<00:14:27.870>the <00:14:28.103>code <00:14:28.336>of <00:14:28.570>the <00:14:28.803>u <00:14:29.036>l <00:14:29.270>path.

223
00:14:30.450 --> 00:14:35.270
<00:14:30.450>And <00:14:30.532>then <00:14:30.614>you <00:14:30.697>can <00:14:30.779>normalize <00:14:30.861>it <00:14:30.944>to <00:14:31.026>get <00:14:31.108>rid <00:14:31.191>of <00:14:31.273>the <00:14:31.355>dot <00:14:31.438>slash <00:14:31.520>and <00:14:31.602>then <00:14:31.685>you <00:14:31.767>can, <00:14:31.850>uh,

224
00:14:35.670 --> 00:14:39.590
<00:14:35.670>actually <00:14:35.763>put <00:14:35.856>the <00:14:35.949>path <00:14:36.043>related <00:14:36.136>or <00:14:36.229>a <00:14:36.323>path <00:14:36.416>joint <00:14:36.510>if <00:14:36.603>you <00:14:36.696>want <00:14:36.790>to <00:14:36.883>use <00:14:36.976>those, <00:14:37.069>uh,

225
00:14:39.690 --> 00:14:40.750
<00:14:39.690>the <00:14:40.167>specific <00:14:40.644>function.

226
00:14:43.010 --> 00:14:46.830
<00:14:43.010>So <00:14:43.150>let's <00:14:43.290>see <00:14:43.430>another <00:14:43.569>example <00:14:43.710>within <00:14:43.850>the, <00:14:43.990>uh, <00:14:44.130>via <00:14:44.270>studio <00:14:44.410>codes.

227
00:14:46.930 --> 00:14:50.230
<00:14:46.930>So <00:14:47.069>I've <00:14:47.209>showed <00:14:47.349>you <00:14:47.489>one <00:14:47.630>example <00:14:47.770>within, <00:14:47.910>uh, <00:14:48.050>a <00:14:48.189>mail <00:14:48.329>server.

228
00:14:50.300 --> 00:14:55.200
<00:14:50.300>I've <00:14:50.393>showed <00:14:50.486>an <00:14:50.579>example <00:14:50.673>within <00:14:50.766>the <00:14:50.859>N <00:14:50.953>P <00:14:51.046>M <00:14:51.140>package. <00:14:51.233>And <00:14:51.326>this <00:14:51.420>one <00:14:51.513>is <00:14:51.606>different, <00:14:51.699>uh,

229
00:14:55.200 --> 00:14:58.280
<00:14:55.200>because <00:14:55.316>this <00:14:55.433>is <00:14:55.550>actually, <00:14:55.666>this <00:14:55.783>is <00:14:55.900>not <00:14:56.016>deploy <00:14:56.133>code. <00:14:56.250>This <00:14:56.366>is <00:14:56.483>within <00:14:56.600>our,

230
00:14:58.300 --> 00:15:02.740
<00:14:58.300>our <00:14:58.533>machine. <00:14:58.766>And <00:14:59.000>one <00:14:59.233>of <00:14:59.466>the, <00:14:59.699>uh,

231
00:15:04.000 --> 00:15:04.700
<00:15:04.000>one <00:15:04.210>of <00:15:04.420>the, <00:15:04.630>uh,

232
00:15:04.700 --> 00:15:07.380
<00:15:04.700>the <00:15:04.816>extension <00:15:04.933>that <00:15:05.050>I'm <00:15:05.166>gonna <00:15:05.283>talk <00:15:05.400>about <00:15:05.516>today <00:15:05.633>is <00:15:05.750>open <00:15:05.866>in <00:15:05.983>default <00:15:06.100>browser.

233
00:15:07.520 --> 00:15:11.060
<00:15:07.520>And <00:15:07.660>as <00:15:07.800>it's <00:15:07.939>named <00:15:08.079>stand <00:15:08.220>is <00:15:08.360>actually <00:15:08.500>open <00:15:08.640>in <00:15:08.780>default <00:15:08.920>browser,

234
00:15:11.160 --> 00:15:15.340
<00:15:11.160>but <00:15:11.315>actually <00:15:11.471>right <00:15:11.626>clicking <00:15:11.782>in, <00:15:11.937>um, <00:15:12.093>the <00:15:12.248>VS <00:15:12.404>code <00:15:12.560>extension.

235
00:15:15.340 --> 00:15:18.980
<00:15:15.340>So <00:15:15.467>you <00:15:15.594>can <00:15:15.721>see <00:15:15.849>like <00:15:15.976>the <00:15:16.103>animated <00:15:16.230>gi, <00:15:16.358>how <00:15:16.485>it <00:15:16.612>looks <00:15:16.740>like,

236
00:15:21.480 --> 00:15:24.780
<00:15:21.480>but <00:15:21.580>basically <00:15:21.680>to <00:15:21.780>give <00:15:21.880>you <00:15:21.980>a <00:15:22.080>little <00:15:22.180>bit <00:15:22.280>more <00:15:22.380>context <00:15:22.480>of <00:15:22.580>the <00:15:22.680>scope <00:15:22.780>and <00:15:22.880>the

237
00:15:24.780 --> 00:15:28.780
<00:15:24.780>impacts. <00:15:24.880>So <00:15:24.980>it's <00:15:25.079>a <00:15:25.180>tiny <00:15:25.280>add-on. <00:15:25.380>If <00:15:25.480>you <00:15:25.579>think <00:15:25.680>about <00:15:25.780>it <00:15:25.880>on <00:15:25.980>the <00:15:26.079>Vs. <00:15:26.180>Uh,

238
00:15:28.920 --> 00:15:30.900
<00:15:28.920>on <00:15:29.120>the <00:15:29.319>VS <00:15:29.520>code <00:15:29.719>marketplace, <00:15:29.920>it's <00:15:30.120>quite <00:15:30.319>popular.

239
00:15:31.260 --> 00:15:35.180
<00:15:31.260>'cause <00:15:31.376>at <00:15:31.493>the <00:15:31.610>moment <00:15:31.726>it <00:15:31.843>almost <00:15:31.960>had <00:15:32.076>a <00:15:32.193>million <00:15:32.310>downloads <00:15:32.426>to <00:15:32.543>date. <00:15:32.660>Um,

240
00:15:36.800 --> 00:15:40.700
<00:15:36.800>and <00:15:36.927>so, <00:15:37.054>uh, <00:15:37.181>I'm <00:15:37.309>just <00:15:37.436>gonna <00:15:37.563>demo <00:15:37.690>how <00:15:37.818>this <00:15:37.945>is <00:15:38.072>actually <00:15:38.199>working.

241
00:15:40.960 --> 00:15:45.900
<00:15:40.960>So <00:15:41.053>let's <00:15:41.146>imagine, <00:15:41.240>let's <00:15:41.333>see <00:15:41.426>how, <00:15:41.520>how <00:15:41.613>it <00:15:41.706>takes <00:15:41.800>place. <00:15:41.893>So <00:15:41.986>you <00:15:42.080>have <00:15:42.173>on <00:15:42.266>the, <00:15:42.360>uh,

242
00:15:45.900 --> 00:15:49.380
<00:15:45.900>on <00:15:46.000>the <00:15:46.100>right <00:15:46.199>side, <00:15:46.300>you <00:15:46.400>do <00:15:46.500>have <00:15:46.600>the, <00:15:46.699>uh, <00:15:46.800>so <00:15:46.900>the <00:15:47.000>VS <00:15:47.100>two <00:15:47.199>D <00:15:47.300>code,

243
00:15:49.380 --> 00:15:52.260
<00:15:49.380>and <00:15:49.555>we <00:15:49.730>we're <00:15:49.905>assuming <00:15:50.080>that <00:15:50.255>you've <00:15:50.430>actually <00:15:50.605>already, <00:15:50.780>uh,

244
00:15:52.260 --> 00:15:55.980
<00:15:52.260>installed <00:15:52.360>it <00:15:52.460>and <00:15:52.560>then <00:15:52.660>you're, <00:15:52.760>you're <00:15:52.860>using <00:15:52.960>it. <00:15:53.060>And <00:15:53.160>on <00:15:53.260>the, <00:15:53.360>uh, <00:15:53.460>the <00:15:53.560>right <00:15:53.660>side,

245
00:15:56.280 --> 00:16:00.220
<00:15:56.280>you <00:15:56.407>have <00:15:56.534>like <00:15:56.661>typical <00:15:56.789>browser, <00:15:56.916>uh, <00:15:57.043>where <00:15:57.170>you're <00:15:57.298>gonna <00:15:57.425>open <00:15:57.552>this <00:15:57.680>documents.

246
00:16:01.530 --> 00:16:04.670
<00:16:01.530>So <00:16:01.630>here <00:16:01.730>we <00:16:01.829>have <00:16:01.930>an <00:16:02.030>index <00:16:02.130>file <00:16:02.230>with <00:16:02.329>nothing <00:16:02.430>fancy <00:16:02.530>on <00:16:02.630>this, <00:16:02.730>just <00:16:02.829>like <00:16:02.930>estimation,

247
00:16:04.810 --> 00:16:08.270
<00:16:04.810>uh, <00:16:04.937>uh, <00:16:05.064>points. <00:16:05.191>And <00:16:05.319>we've <00:16:05.446>actually <00:16:05.573>right <00:16:05.700>click. <00:16:05.828>And <00:16:05.955>this <00:16:06.082>is, <00:16:06.209>uh,

248
00:16:08.430 --> 00:16:10.590
<00:16:08.430>opening <00:16:08.604>the <00:16:08.780>documents <00:16:08.954>on <00:16:09.130>the, <00:16:09.305>uh, <00:16:09.479>the <00:16:09.655>left <00:16:09.829>side.

249
00:16:11.210 --> 00:16:14.270
<00:16:11.210>So <00:16:11.317>you <00:16:11.425>can <00:16:11.533>see <00:16:11.640>it's <00:16:11.748>actually <00:16:11.856>rendered. <00:16:11.963>So, <00:16:12.071>so <00:16:12.179>far <00:16:12.286>it's <00:16:12.394>so <00:16:12.502>good. <00:16:12.610>Nothing,

250
00:16:14.410 --> 00:16:19.360
<00:16:14.410>no <00:16:14.517>security <00:16:14.625>issues <00:16:14.733>here. <00:16:14.840>The <00:16:14.948>thing <00:16:15.056>is, <00:16:15.163>we're <00:16:15.271>at <00:16:15.379>the, <00:16:15.486>uh, <00:16:15.594>the <00:16:15.702>attacker <00:16:15.810>shoes,

251
00:16:19.500 --> 00:16:22.840
<00:16:19.500>and <00:16:19.655>now <00:16:19.811>the <00:16:19.966>attacker <00:16:20.122>will <00:16:20.277>actually <00:16:20.433>open <00:16:20.588>three <00:16:20.744>sub <00:16:20.900>terminals.

252
00:16:23.260 --> 00:16:24.720
<00:16:23.260>So <00:16:23.479>the <00:16:23.698>first <00:16:23.917>one <00:16:24.136>on <00:16:24.355>the, <00:16:24.574>uh,

253
00:16:24.780 --> 00:16:28.760
<00:16:24.780>the <00:16:24.887>far <00:16:24.995>left <00:16:25.103>side <00:16:25.210>is <00:16:25.318>just <00:16:25.426>to <00:16:25.533>serve <00:16:25.641>the <00:16:25.749>local <00:16:25.856>file <00:16:25.964>to <00:16:26.072>be <00:16:26.180>available.

254
00:16:28.820 --> 00:16:31.080
<00:16:28.820>So <00:16:28.960>it's <00:16:29.100>using <00:16:29.240>P <00:16:29.380>H <00:16:29.520>P <00:16:29.660>in <00:16:29.800>the, <00:16:29.940>in <00:16:30.080>that <00:16:30.220>sense,

255
00:16:31.540 --> 00:16:36.520
<00:16:31.540>the <00:16:31.627>one <00:16:31.714>in <00:16:31.802>the <00:16:31.890>middle <00:16:31.977>is <00:16:32.064>using <00:16:32.152>NRO <00:16:32.240>to <00:16:32.327>serve <00:16:32.415>the <00:16:32.502>file <00:16:32.589>over <00:16:32.677>the, <00:16:32.765>uh, <00:16:32.852>the <00:16:32.939>networks.

256
00:16:36.620 --> 00:16:41.360
<00:16:36.620>So <00:16:36.713>just <00:16:36.806>to <00:16:36.900>understand, <00:16:36.993>this <00:16:37.086>is <00:16:37.180>not <00:16:37.273>a <00:16:37.366>local <00:16:37.460>attack. <00:16:37.553>This <00:16:37.646>is <00:16:37.740>actually <00:16:37.833>in <00:16:37.926>the, <00:16:38.020>um,

257
00:16:41.660 --> 00:16:45.920
<00:16:41.660>public <00:16:41.760>available. <00:16:41.860>And <00:16:41.959>the <00:16:42.060>one <00:16:42.160>in <00:16:42.260>the <00:16:42.360>end <00:16:42.459>is <00:16:42.560>also <00:16:42.660>from <00:16:42.760>the, <00:16:42.860>um, <00:16:42.959>the, <00:16:43.060>uh,

258
00:16:45.920 --> 00:16:49.120
<00:16:45.920>the <00:16:46.075>attacker <00:16:46.231>is <00:16:46.386>also <00:16:46.542>to, <00:16:46.697>to <00:16:46.853>capture <00:16:47.008>the, <00:16:47.164>um, <00:16:47.319>the,

259
00:16:49.140 --> 00:16:51.360
<00:16:49.140>the <00:16:49.340>files <00:16:49.540>potentially <00:16:49.740>from <00:16:49.939>the, <00:16:50.140>uh, <00:16:50.340>the <00:16:50.540>machine.

260
00:16:53.900 --> 00:16:58.120
<00:16:53.900>So <00:16:54.040>here <00:16:54.180>we <00:16:54.319>can <00:16:54.459>actually <00:16:54.600>track <00:16:54.740>a <00:16:54.880>user <00:16:55.020>to <00:16:55.160>clicking, <00:16:55.300>um,

261
00:16:58.560 --> 00:17:01.360
<00:16:58.560>a <00:16:58.687>link. <00:16:58.814>And <00:16:58.941>actually <00:16:59.069>this <00:16:59.196>is <00:16:59.323>quite, <00:16:59.450>uh, <00:16:59.578>uh, <00:16:59.705>easy <00:16:59.832>to <00:16:59.959>do.

262
00:17:01.460 --> 00:17:03.200
<00:17:01.460>The <00:17:01.740>only <00:17:02.020>condition <00:17:02.300>for <00:17:02.580>this, <00:17:02.860>um,

263
00:17:03.270 --> 00:17:06.920
<00:17:03.270>this <00:17:03.425>vulnerability <00:17:03.581>to <00:17:03.736>work <00:17:03.892>is <00:17:04.047>to <00:17:04.203>have <00:17:04.358>that <00:17:04.514>extension <00:17:04.670>running.

264
00:17:07.060 --> 00:17:11.840
<00:17:07.060>So <00:17:07.167>as <00:17:07.275>developers, <00:17:07.383>you <00:17:07.490>might <00:17:07.598>have <00:17:07.706>their <00:17:07.813>VS <00:17:07.921>codes <00:17:08.029>already <00:17:08.136>open. <00:17:08.244>And <00:17:08.352>this, <00:17:08.460>uh,

265
00:17:11.840 --> 00:17:14.080
<00:17:11.839>this <00:17:12.073>application <00:17:12.306>already <00:17:12.540>opening <00:17:12.773>some, <00:17:13.006>some <00:17:13.240>files.

266
00:17:14.620 --> 00:17:18.720
<00:17:14.619>So <00:17:14.727>if <00:17:14.835>I <00:17:14.943>trick <00:17:15.050>you <00:17:15.158>by <00:17:15.266>clicking, <00:17:15.373>uh, <00:17:15.481>one <00:17:15.589>of <00:17:15.696>the <00:17:15.804>link, <00:17:15.912>actually <00:17:16.020>what,

267
00:17:18.720 --> 00:17:21.800
<00:17:18.720>what <00:17:18.819>will <00:17:18.920>happen <00:17:19.020>here, <00:17:19.120>you <00:17:19.220>can <00:17:19.319>see <00:17:19.420>at <00:17:19.520>the, <00:17:19.620>at <00:17:19.720>the <00:17:19.819>bottom, <00:17:19.920>uh, <00:17:20.020>there's, <00:17:20.120>um,

268
00:17:22.600 --> 00:17:26.720
<00:17:22.599>a <00:17:22.707>document <00:17:22.815>that <00:17:22.923>has <00:17:23.030>been <00:17:23.138>downloaded. <00:17:23.246>So <00:17:23.353>it's <00:17:23.461>actually <00:17:23.569>filling <00:17:23.676>the, <00:17:23.784>uh, <00:17:23.892>the <00:17:24.000>user.

269
00:17:28.770 --> 00:17:32.670
<00:17:28.770>And <00:17:28.877>then <00:17:28.985>you <00:17:29.093>can <00:17:29.200>see <00:17:29.308>it <00:17:29.416>has <00:17:29.523>been <00:17:29.631>copied <00:17:29.739>and <00:17:29.846>downloaded <00:17:29.954>in <00:17:30.062>the, <00:17:30.170>uh,

270
00:17:32.770 --> 00:17:35.670
<00:17:32.770>the <00:17:32.925>attacker <00:17:33.081>server. <00:17:33.236>In <00:17:33.392>that <00:17:33.547>case, <00:17:33.703>this <00:17:33.858>was <00:17:34.014>really <00:17:34.170>specific.

271
00:17:35.730 --> 00:17:40.070
<00:17:35.730>It <00:17:35.807>was <00:17:35.885>looking <00:17:35.963>for <00:17:36.041>a <00:17:36.118>key <00:17:36.196>dot <00:17:36.274>T <00:17:36.352>X <00:17:36.430>T, <00:17:36.507>which <00:17:36.585>was <00:17:36.663>handing <00:17:36.741>some <00:17:36.818>s <00:17:36.896>s <00:17:36.974>h <00:17:37.052>key, <00:17:37.130>uh,

272
00:17:40.090 --> 00:17:43.750
<00:17:40.090>on <00:17:40.197>the, <00:17:40.305>on <00:17:40.413>the <00:17:40.520>host <00:17:40.628>about <00:17:40.736>it, <00:17:40.843>actually <00:17:40.951>managed <00:17:41.059>to <00:17:41.166>transfer <00:17:41.274>it <00:17:41.382>to <00:17:41.490>the,

273
00:17:43.970 --> 00:17:46.870
<00:17:43.970>the <00:17:44.145>attacker <00:17:44.320>server. <00:17:44.495>And <00:17:44.670>now <00:17:44.845>the <00:17:45.020>attacker, <00:17:45.195>the, <00:17:45.370>uh,

274
00:17:46.870 --> 00:17:49.840
<00:17:46.870>the <00:17:47.070>attacker <00:17:47.270>has <00:17:47.469>access <00:17:47.669>to <00:17:47.870>that <00:17:48.070>specific <00:17:48.270>information.

275
00:17:51.990 --> 00:17:54.450
<00:17:51.990>So <00:17:52.130>let's <00:17:52.270>say, <00:17:52.410>let's <00:17:52.550>see <00:17:52.690>what, <00:17:52.830>what, <00:17:52.970>what <00:17:53.110>is <00:17:53.250>happening <00:17:53.390>here.

276
00:17:54.510 --> 00:17:57.770
<00:17:54.510>So <00:17:54.637>this <00:17:54.764>is <00:17:54.891>a <00:17:55.019>piece <00:17:55.146>of <00:17:55.273>code <00:17:55.400>from <00:17:55.528>the, <00:17:55.655>uh, <00:17:55.782>this <00:17:55.910>extension.

277
00:17:57.770 --> 00:18:02.460
<00:17:57.770>And <00:17:57.870>let's <00:17:57.970>try <00:17:58.070>to <00:17:58.170>understand <00:17:58.270>what <00:17:58.370>is, <00:17:58.470>what <00:17:58.570>is <00:17:58.670>happening. <00:17:58.770>So <00:17:58.870>here <00:17:58.970>I <00:17:59.070>kind, <00:17:59.170>uh,

278
00:18:02.570 --> 00:18:05.860
<00:18:02.570>I'll, <00:18:02.686>um, <00:18:02.803>I <00:18:02.919>highlight <00:18:03.036>the, <00:18:03.153>uh, <00:18:03.270>the <00:18:03.386>different <00:18:03.503>function <00:18:03.620>that <00:18:03.736>is <00:18:03.853>interested <00:18:03.970>for,

279
00:18:06.000 --> 00:18:10.840
<00:18:06.000>for <00:18:06.127>us. <00:18:06.254>And <00:18:06.381>here <00:18:06.509>we <00:18:06.636>can <00:18:06.763>see <00:18:06.890>that <00:18:07.018>this <00:18:07.145>one <00:18:07.272>has <00:18:07.400>been,

280
00:18:11.140 --> 00:18:11.940
<00:18:11.140>uh, <00:18:11.860>encoded.

281
00:18:11.940 --> 00:18:16.440
<00:18:11.940>So <00:18:12.047>being <00:18:12.155>familiar <00:18:12.263>with <00:18:12.370>the <00:18:12.478>percent <00:18:12.586>two <00:18:12.693>E <00:18:12.801>'cause <00:18:12.909>the <00:18:13.016>attacker's <00:18:13.124>trying <00:18:13.232>to, <00:18:13.340>uh,

282
00:18:16.620 --> 00:18:19.990
<00:18:16.620>bypass <00:18:16.899>it. <00:18:17.179>So <00:18:17.459>it's <00:18:17.739>being <00:18:18.020>decoded.

283
00:18:20.010 --> 00:18:22.230
<00:18:20.010>So <00:18:20.290>we <00:18:20.570>have <00:18:20.850>the.dot/in <00:18:21.129>that <00:18:21.410>case,

284
00:18:23.530 --> 00:18:28.000
<00:18:23.530>but <00:18:23.646>then <00:18:23.763>when <00:18:23.879>it's <00:18:23.996>getting <00:18:24.113>resolved, <00:18:24.230>it's <00:18:24.346>getting <00:18:24.463>resolved <00:18:24.580>and <00:18:24.696>attached <00:18:24.813>to <00:18:24.930>the,

285
00:18:28.020 --> 00:18:31.320
<00:18:28.020>uh, <00:18:28.160>the <00:18:28.300>home <00:18:28.440>directory. <00:18:28.580>And <00:18:28.720>potentially <00:18:28.860>if <00:18:29.000>you <00:18:29.139>have <00:18:29.280>any <00:18:29.420>projects,

286
00:18:31.320 --> 00:18:35.880
<00:18:31.320>unfortunately <00:18:31.436>here, <00:18:31.553>because <00:18:31.669>we're <00:18:31.786>targeting <00:18:31.903>the, <00:18:32.020>uh, <00:18:32.136>the <00:18:32.253>s <00:18:32.370>h <00:18:32.486>key, <00:18:32.603>this <00:18:32.720>allows,

287
00:18:36.020 --> 00:18:38.960
<00:18:36.020>uh, <00:18:36.220>an <00:18:36.420>attacker <00:18:36.620>to <00:18:36.820>actually <00:18:37.020>fetch <00:18:37.220>those. <00:18:37.420>Um,

288
00:18:39.260 --> 00:18:41.720
<00:18:39.260>and <00:18:39.435>this <00:18:39.610>is <00:18:39.785>quite <00:18:39.960>problematic <00:18:40.135>as <00:18:40.310>you <00:18:40.485>might <00:18:40.660>imagine.

289
00:18:43.770 --> 00:18:48.030
<00:18:43.770>So <00:18:43.945>this, <00:18:44.120>um, <00:18:44.295>this <00:18:44.470>security <00:18:44.645>vulnerability, <00:18:44.820>uh, <00:18:44.995>was, <00:18:45.170>uh,

290
00:18:48.650 --> 00:18:52.590
<00:18:48.650>um, <00:18:48.743>has, <00:18:48.836>uh, <00:18:48.930>reduce, <00:18:49.023>we <00:18:49.116>do <00:18:49.210>have <00:18:49.303>a <00:18:49.396>blog, <00:18:49.490>sorry, <00:18:49.583>for, <00:18:49.676>uh, <00:18:49.770>covering <00:18:49.863>also <00:18:49.956>this, <00:18:50.050>uh,

291
00:18:53.170 --> 00:18:55.110
<00:18:53.170>uh, <00:18:53.450>this <00:18:53.730>specific, <00:18:54.010>uh, <00:18:54.290>screen <00:18:54.570>vulnerability.

292
00:18:55.130 --> 00:18:58.590
<00:18:55.130>So <00:18:55.223>if <00:18:55.316>you're <00:18:55.410>interested <00:18:55.503>to <00:18:55.596>learn <00:18:55.690>a <00:18:55.783>bit <00:18:55.876>more, <00:18:55.970>'cause <00:18:56.063>it's <00:18:56.156>not <00:18:56.250>only <00:18:56.343>for <00:18:56.436>this, <00:18:56.530>um,

293
00:18:59.100 --> 00:19:02.470
<00:18:59.100>extension, <00:18:59.255>there's <00:18:59.411>other <00:18:59.566>extensions <00:18:59.722>actually <00:18:59.877>that <00:19:00.033>are <00:19:00.188>also <00:19:00.344>also <00:19:00.500>vulnerable.

294
00:19:02.470 --> 00:19:04.790
<00:19:02.470>So <00:19:02.610>if <00:19:02.750>you <00:19:02.890>want <00:19:03.030>to <00:19:03.170>learn <00:19:03.310>more <00:19:03.450>about <00:19:03.590>this <00:19:03.730>vulnerable <00:19:03.870>extensions,

295
00:19:04.890 --> 00:19:07.590
<00:19:04.890>you <00:19:05.065>can <00:19:05.240>have <00:19:05.415>a <00:19:05.590>look <00:19:05.765>at <00:19:05.940>this <00:19:06.115>block <00:19:06.290>file.

296
00:19:09.490 --> 00:19:12.390
<00:19:09.490>So <00:19:09.723>the <00:19:09.956>concerning <00:19:10.190>thing <00:19:10.423>also <00:19:10.656>for <00:19:10.890>this,

297
00:19:12.490 --> 00:19:16.550
<00:19:12.490>and <00:19:12.583>that <00:19:12.676>we <00:19:12.770>need <00:19:12.863>to <00:19:12.956>keep <00:19:13.050>in <00:19:13.143>mind <00:19:13.236>is <00:19:13.330>who <00:19:13.423>is <00:19:13.516>auditing <00:19:13.610>those <00:19:13.703>vs <00:19:13.796>code <00:19:13.890>extensions?

298
00:19:17.200 --> 00:19:19.530
<00:19:17.200>Well, <00:19:17.400>actually <00:19:17.600>on <00:19:17.800>the <00:19:18.000>marketplace, <00:19:18.200>there's <00:19:18.400>no, <00:19:18.600>uh,

299
00:19:19.730 --> 00:19:22.450
<00:19:19.730>security <00:19:19.930>measures <00:19:20.130>to <00:19:20.330>vet <00:19:20.530>for <00:19:20.730>those, <00:19:20.930>those <00:19:21.130>extensions.

300
00:19:22.710 --> 00:19:24.570
<00:19:22.710>So <00:19:22.943>none <00:19:23.176>of <00:19:23.410>the <00:19:23.643>industry <00:19:23.876>leading, <00:19:24.110>um,

301
00:19:24.670 --> 00:19:28.370
<00:19:24.670>the <00:19:24.825>software <00:19:24.981>composition <00:19:25.136>analysis <00:19:25.292>tools <00:19:25.447>is <00:19:25.603>actively <00:19:25.758>scanning <00:19:25.914>for <00:19:26.070>those

302
00:19:28.370 --> 00:19:30.490
<00:19:28.370>vulnerabilities <00:19:28.836>in <00:19:29.303>extension. <00:19:29.770>Thus,

303
00:19:30.510 --> 00:19:34.010
<00:19:30.510>we <00:19:30.626>don't <00:19:30.743>have <00:19:30.860>any <00:19:30.976>cvs <00:19:31.093>also <00:19:31.210>to <00:19:31.326>track <00:19:31.443>that <00:19:31.560>kind <00:19:31.676>of <00:19:31.793>of <00:19:31.910>vulnerabilities.

304
00:19:34.310 --> 00:19:37.850
<00:19:34.310>And <00:19:34.450>there's <00:19:34.590>also <00:19:34.730>no <00:19:34.870>alert <00:19:35.010>mechanisms, <00:19:35.149>uh, <00:19:35.290>to <00:19:35.429>alert <00:19:35.570>the, <00:19:35.710>uh,

305
00:19:37.850 --> 00:19:41.250
<00:19:37.850>the <00:19:38.005>developers <00:19:38.161>if <00:19:38.316>one <00:19:38.472>of <00:19:38.627>the <00:19:38.783>extension <00:19:38.938>is <00:19:39.094>actually <00:19:39.250>vulnerable.

306
00:19:42.640 --> 00:19:42.930
Also,

307
00:19:42.930 --> 00:19:47.130
<00:19:42.930>the <00:19:43.037>important <00:19:43.145>thing <00:19:43.253>to <00:19:43.360>keep <00:19:43.468>in <00:19:43.576>mind <00:19:43.683>is <00:19:43.791>as <00:19:43.899>developer <00:19:44.006>will <00:19:44.114>actually <00:19:44.222>target <00:19:44.330>it,

308
00:19:48.070 --> 00:19:52.720
<00:19:48.070>and <00:19:48.177>this <00:19:48.285>is <00:19:48.393>the <00:19:48.500>essence <00:19:48.608>of <00:19:48.716>supply <00:19:48.823>chain <00:19:48.931>security. <00:19:49.039>So <00:19:49.146>we <00:19:49.254>know <00:19:49.362>the <00:19:49.470>developers,

309
00:19:52.720 --> 00:19:55.120
<00:19:52.720>they <00:19:52.895>have <00:19:53.070>access <00:19:53.245>to <00:19:53.420>sensitive <00:19:53.595>systems <00:19:53.770>to <00:19:53.945>source <00:19:54.120>code,

310
00:19:55.120 --> 00:19:57.120
<00:19:55.120>to <00:19:55.586>database <00:19:56.053>and <00:19:56.520>infrastructures.

311
00:19:57.120 --> 00:20:01.200
<00:19:57.120>And <00:19:57.236>so <00:19:57.353>compromising <00:19:57.469>a <00:19:57.586>developer's <00:19:57.703>accounts <00:19:57.820>can <00:19:57.936>provide <00:19:58.053>a <00:19:58.169>wide <00:19:58.286>attack <00:19:58.403>surface <00:19:58.520>in

312
00:20:01.240 --> 00:20:03.440
<00:20:01.240>a <00:20:01.706>sense. <00:20:02.173>And <00:20:02.640>also,

313
00:20:03.440 --> 00:20:07.880
<00:20:03.440>we <00:20:03.547>know <00:20:03.655>that <00:20:03.763>many <00:20:03.870>developers <00:20:03.978>may <00:20:04.086>work <00:20:04.193>on <00:20:04.301>high <00:20:04.409>value <00:20:04.516>projects <00:20:04.624>that <00:20:04.732>are <00:20:04.840>actually

314
00:20:07.880 --> 00:20:12.850
<00:20:07.880>an <00:20:08.160>attractive <00:20:08.440>targets. <00:20:08.720>So <00:20:09.000>let's <00:20:09.280>see,

315
00:20:12.950 --> 00:20:15.450
<00:20:12.950>one <00:20:13.150>last <00:20:13.350>example <00:20:13.550>with <00:20:13.750>the <00:20:13.950>no <00:20:14.150>JSS <00:20:14.350>runtime.

316
00:20:18.200 --> 00:20:22.620
<00:20:18.200>So <00:20:18.287>this <00:20:18.375>was <00:20:18.462>part <00:20:18.550>of <00:20:18.637>the, <00:20:18.725>uh, <00:20:18.812>the, <00:20:18.900>uh, <00:20:18.987>the <00:20:19.075>fix. <00:20:19.162>Um, <00:20:19.250>I <00:20:19.337>know <00:20:19.425>it's <00:20:19.512>quite <00:20:19.600>small,

317
00:20:22.620 --> 00:20:24.980
<00:20:22.620>but <00:20:22.747>just, <00:20:22.874>um, <00:20:23.001>this <00:20:23.129>is <00:20:23.256>just <00:20:23.383>to, <00:20:23.510>to <00:20:23.638>show <00:20:23.765>you <00:20:23.892>the, <00:20:24.020>uh,

318
00:20:25.160 --> 00:20:27.500
<00:20:25.160>one <00:20:25.335>of <00:20:25.510>the <00:20:25.685>function <00:20:25.860>is <00:20:26.035>called <00:20:26.210>normalize <00:20:26.385>string <00:20:26.560>pos.

319
00:20:27.680 --> 00:20:31.740
<00:20:27.680>And <00:20:27.787>this <00:20:27.895>function <00:20:28.003>is <00:20:28.110>used <00:20:28.218>to <00:20:28.326>normalize <00:20:28.433>the <00:20:28.541>file <00:20:28.649>path <00:20:28.756>string <00:20:28.864>in <00:20:28.972>no <00:20:29.080>jss,

320
00:20:31.810 --> 00:20:36.220
<00:20:31.810>unfortunately, <00:20:31.937>they <00:20:32.064>didn't <00:20:32.191>sanitize <00:20:32.319>and <00:20:32.446>validate <00:20:32.573>enough <00:20:32.700>in <00:20:32.828>a, <00:20:32.955>in <00:20:33.082>a <00:20:33.210>sense.

321
00:20:37.920 --> 00:20:41.820
<00:20:37.920>So <00:20:38.060>what <00:20:38.200>was <00:20:38.340>expected <00:20:38.480>actually <00:20:38.620>wasn't <00:20:38.760>the, <00:20:38.900>uh, <00:20:39.040>reflected <00:20:39.180>the, <00:20:39.320>uh,

322
00:20:41.840 --> 00:20:44.220
<00:20:41.840>the <00:20:41.995>expected <00:20:42.151>behavior <00:20:42.306>as <00:20:42.462>you <00:20:42.617>can <00:20:42.773>see <00:20:42.928>here. <00:20:43.084>For <00:20:43.240>example,

323
00:20:44.220 --> 00:20:47.560
<00:20:44.220>we <00:20:44.336>we're <00:20:44.453>expecting <00:20:44.570>the <00:20:44.686>slash <00:20:44.803>e <00:20:44.920>TC <00:20:45.036>password <00:20:45.153>and <00:20:45.270>we <00:20:45.386>had <00:20:45.503>something <00:20:45.620>completely

324
00:20:47.560 --> 00:20:51.920
<00:20:47.560>different. <00:20:47.687>And <00:20:47.814>the <00:20:47.941>same <00:20:48.069>was <00:20:48.196>for <00:20:48.323>the, <00:20:48.450>um, <00:20:48.578>the <00:20:48.705>resolve <00:20:48.832>and <00:20:48.960>join.

325
00:20:55.450 --> 00:20:58.710
<00:20:55.450>So <00:20:55.625>let's <00:20:55.800>assume, <00:20:55.975>let's <00:20:56.150>imagine <00:20:56.325>then <00:20:56.500>we're <00:20:56.675>creating, <00:20:56.850>um,

326
00:20:59.150 --> 00:21:03.230
<00:20:59.150>a <00:20:59.250>small <00:20:59.350>like <00:20:59.450>server <00:20:59.550>jss <00:20:59.650>file, <00:20:59.750>uh, <00:20:59.850>just <00:20:59.950>to <00:21:00.050>spin <00:21:00.150>up, <00:21:00.250>um, <00:21:00.350>a <00:21:00.450>small, <00:21:00.550>uh,

327
00:21:03.230 --> 00:21:07.310
<00:21:03.230>express <00:21:03.357>application. <00:21:03.484>The <00:21:03.611>most <00:21:03.739>important, <00:21:03.866>uh, <00:21:03.993>bit <00:21:04.120>is <00:21:04.248>to <00:21:04.375>have <00:21:04.502>this, <00:21:04.630>uh,

328
00:21:07.310 --> 00:21:09.550
<00:21:07.310>section <00:21:07.485>on <00:21:07.659>the <00:21:07.835>app <00:21:08.010>dots <00:21:08.185>used <00:21:08.360>with <00:21:08.534>the <00:21:08.710>public.

329
00:21:11.050 --> 00:21:15.150
<00:21:11.050>And <00:21:11.177>if <00:21:11.304>we're <00:21:11.431>doing <00:21:11.559>path <00:21:11.686>reversal <00:21:11.813>using <00:21:11.940>this, <00:21:12.068>um, <00:21:12.195>this <00:21:12.322>little, <00:21:12.450>uh,

330
00:21:15.150 --> 00:21:19.830
<00:21:15.150>snippet <00:21:15.277>of <00:21:15.404>codes <00:21:15.531>actually <00:21:15.659>just <00:21:15.786>to <00:21:15.913>send <00:21:16.040>off, <00:21:16.168>uh, <00:21:16.295>not <00:21:16.422>really <00:21:16.550>specialized,

331
00:21:20.010 --> 00:21:22.910
<00:21:20.010>um, <00:21:20.185>curl <00:21:20.360>requests <00:21:20.535>with <00:21:20.710>this, <00:21:20.885>uh, <00:21:21.060>h <00:21:21.235>p <00:21:21.410>request,

332
00:21:23.510 --> 00:21:27.250
<00:21:23.510>but <00:21:23.685>you <00:21:23.860>can <00:21:24.035>still <00:21:24.210>be <00:21:24.385>able <00:21:24.560>to <00:21:24.735>traverse <00:21:24.910>again,

333
00:21:27.550 --> 00:21:31.170
<00:21:27.550>the <00:21:27.649>node <00:21:27.750>runtime <00:21:27.850>and <00:21:27.950>you <00:21:28.050>can <00:21:28.149>see <00:21:28.250>it's <00:21:28.350>vulnerable <00:21:28.450>and <00:21:28.550>you <00:21:28.649>have <00:21:28.750>access <00:21:28.850>to <00:21:28.950>the

334
00:21:31.170 --> 00:21:35.610
<00:21:31.170>server <00:21:31.297>jss <00:21:31.424>in <00:21:31.551>that <00:21:31.679>specific <00:21:31.806>case <00:21:31.933>using <00:21:32.060>this, <00:21:32.188>uh, <00:21:32.315>this <00:21:32.442>curl <00:21:32.570>request.

335
00:21:36.660 --> 00:21:40.640
<00:21:36.660>So <00:21:36.760>this <00:21:36.860>was <00:21:36.960>quite <00:21:37.060>a <00:21:37.160>critical <00:21:37.260>one <00:21:37.360>in <00:21:37.460>node <00:21:37.560>jss <00:21:37.660>and <00:21:37.760>also <00:21:37.860>a <00:21:37.960>specific <00:21:38.060>version.

336
00:21:41.180 --> 00:21:43.800
<00:21:41.180>By <00:21:41.320>the <00:21:41.460>way, <00:21:41.600>if <00:21:41.740>you're <00:21:41.880>still <00:21:42.020>using <00:21:42.160>this <00:21:42.300>version <00:21:42.440>in <00:21:42.580>production,

337
00:21:43.800 --> 00:21:47.060
<00:21:43.800>make <00:21:43.940>sure <00:21:44.080>to <00:21:44.220>upgrade <00:21:44.360>it <00:21:44.500>to <00:21:44.639>one <00:21:44.780>that <00:21:44.919>is <00:21:45.060>not <00:21:45.200>valuable,

338
00:21:47.680 --> 00:21:51.680
<00:21:47.680>but <00:21:47.796>let's <00:21:47.913>have <00:21:48.030>a <00:21:48.146>look <00:21:48.263>how <00:21:48.380>it <00:21:48.496>did <00:21:48.613>work. <00:21:48.730>So <00:21:48.846>for <00:21:48.963>a <00:21:49.080>demo,

339
00:21:51.860 --> 00:21:54.120
<00:21:51.860>so <00:21:52.139>I've <00:21:52.419>actually <00:21:52.699>created <00:21:52.979>this, <00:21:53.260>uh,

340
00:21:54.120 --> 00:21:57.960
<00:21:54.120>server <00:21:54.353>JSS <00:21:54.586>file <00:21:54.820>and <00:21:55.053>also <00:21:55.286>dockerizing <00:21:55.520>it.

341
00:21:58.580 --> 00:22:02.820
<00:21:58.580>And <00:21:58.707>I'll <00:21:58.834>take <00:21:58.961>step <00:21:59.089>pack <00:21:59.216>and <00:21:59.343>talk <00:21:59.470>about <00:21:59.598>one <00:21:59.725>of <00:21:59.852>the <00:21:59.980>tools,

342
00:22:02.880 --> 00:22:04.940
<00:22:02.880>the <00:22:03.055>security <00:22:03.230>tools <00:22:03.405>that <00:22:03.580>you <00:22:03.755>can <00:22:03.930>actually <00:22:04.105>find <00:22:04.280>online.

343
00:22:04.960 --> 00:22:07.940
<00:22:04.960>If <00:22:05.060>you <00:22:05.160>do <00:22:05.260>a <00:22:05.360>little <00:22:05.460>bit <00:22:05.560>of <00:22:05.660>Googling. <00:22:05.760>This <00:22:05.860>one <00:22:05.960>is <00:22:06.060>a <00:22:06.160>f <00:22:06.260>tool <00:22:06.360>called,

344
00:22:09.040 --> 00:22:13.780
<00:22:09.040>and <00:22:09.147>this <00:22:09.255>is <00:22:09.363>a <00:22:09.470>offensive <00:22:09.578>security <00:22:09.686>tool <00:22:09.793>that <00:22:09.901>is <00:22:10.009>used <00:22:10.116>to <00:22:10.224>actually <00:22:10.332>fuz, <00:22:10.440>um,

345
00:22:14.320 --> 00:22:17.820
<00:22:14.320>the, <00:22:14.427>um, <00:22:14.535>your <00:22:14.643>application <00:22:14.750>and <00:22:14.858>let <00:22:14.966>you <00:22:15.073>know <00:22:15.181>if <00:22:15.289>there's <00:22:15.396>any <00:22:15.504>al <00:22:15.612>if <00:22:15.720>this,

346
00:22:18.080 --> 00:22:21.550
<00:22:18.080>any <00:22:18.280>vulnerability <00:22:18.480>on <00:22:18.679>it. <00:22:18.879>As <00:22:19.080>you <00:22:19.280>can <00:22:19.480>see,

347
00:22:21.620 --> 00:22:25.680
<00:22:21.620>this <00:22:21.775>tool <00:22:21.931>has <00:22:22.086>a <00:22:22.242>lot <00:22:22.397>of <00:22:22.553>a <00:22:22.708>lot <00:22:22.864>of <00:22:23.020>flags.

348
00:22:25.680 --> 00:22:30.450
<00:22:25.680>So <00:22:25.780>there's <00:22:25.880>like <00:22:25.980>a <00:22:26.080>lot <00:22:26.180>of <00:22:26.280>options <00:22:26.380>that <00:22:26.480>it <00:22:26.580>can <00:22:26.680>potentially, <00:22:26.780>um, <00:22:26.880>add <00:22:26.980>through <00:22:27.080>your,

349
00:22:30.510 --> 00:22:35.360
<00:22:30.510>uh, <00:22:30.665>through <00:22:30.821>your <00:22:30.976>command. <00:22:31.132>And <00:22:31.287>here <00:22:31.443>I'm <00:22:31.598>gonna <00:22:31.754>run <00:22:31.910>it,

350
00:22:35.560 --> 00:22:38.560
<00:22:35.560>actually, <00:22:35.715>I'm <00:22:35.871>running <00:22:36.026>it <00:22:36.182>to, <00:22:36.337>um, <00:22:36.493>to <00:22:36.648>actually <00:22:36.804>serve, <00:22:36.960>uh,

351
00:22:38.560 --> 00:22:39.680
<00:22:38.560>to <00:22:38.812>test <00:22:39.064>the <00:22:39.316>server <00:22:39.568>touch.

352
00:22:39.820 --> 00:22:42.320
<00:22:39.820>So <00:22:39.919>I <00:22:40.020>really <00:22:40.120>like <00:22:40.220>the <00:22:40.320>small <00:22:40.419>snippet <00:22:40.520>of <00:22:40.620>code <00:22:40.720>just <00:22:40.820>to <00:22:40.919>see <00:22:41.020>if <00:22:41.120>there's <00:22:41.220>any

353
00:22:42.320 --> 00:22:47.000
<00:22:42.320>vulnerability. <00:22:42.427>So <00:22:42.535>you <00:22:42.643>can <00:22:42.750>imagine <00:22:42.858>it's <00:22:42.966>just <00:22:43.073>five <00:22:43.181>lines <00:22:43.289>of <00:22:43.396>codes <00:22:43.504>running <00:22:43.612>the, <00:22:43.720>uh,

354
00:22:47.020 --> 00:22:48.280
<00:22:47.020>the <00:22:47.303>tool <00:22:47.587>on <00:22:47.870>the <00:22:48.154>right.

355
00:22:49.430 --> 00:22:53.530
<00:22:49.430>So <00:22:49.523>it <00:22:49.616>goes <00:22:49.710>through <00:22:49.803>a <00:22:49.896>lot <00:22:49.990>of <00:22:50.083>those <00:22:50.176>permutations <00:22:50.270>and <00:22:50.363>string <00:22:50.456>just <00:22:50.550>to <00:22:50.643>try <00:22:50.736>if <00:22:50.830>there's

356
00:22:53.530 --> 00:22:56.610
<00:22:53.530>any <00:22:53.657>vulnerability. <00:22:53.784>And <00:22:53.911>it <00:22:54.039>might <00:22:54.166>take <00:22:54.293>a <00:22:54.420>bit <00:22:54.548>of <00:22:54.675>time, <00:22:54.802>but, <00:22:54.930>uh,

357
00:22:56.610 --> 00:22:59.090
<00:22:56.610>for <00:22:56.703>the <00:22:56.796>sake <00:22:56.889>of <00:22:56.983>the, <00:22:57.076>the <00:22:57.169>session, <00:22:57.263>I <00:22:57.356>didn't <00:22:57.449>run <00:22:57.543>it, <00:22:57.636>but <00:22:57.729>you <00:22:57.823>can <00:22:57.916>see <00:22:58.010>it's,

358
00:22:59.090 --> 00:23:03.250
<00:22:59.090>it's <00:22:59.197>actually <00:22:59.305>for <00:22:59.413>this <00:22:59.520>one <00:22:59.628>took <00:22:59.736>six <00:22:59.843>minutes <00:22:59.951>and <00:23:00.059>it <00:23:00.166>broke <00:23:00.274>at <00:23:00.382>the, <00:23:00.490>uh,

359
00:23:03.250 --> 00:23:05.770
<00:23:03.250>it <00:23:03.425>actually <00:23:03.600>stopped <00:23:03.775>at <00:23:03.950>the <00:23:04.125>first <00:23:04.300>instance <00:23:04.475>of <00:23:04.650>vulnerability.

360
00:23:05.830 --> 00:23:09.170
<00:23:05.830>And <00:23:05.970>you <00:23:06.110>can <00:23:06.250>see <00:23:06.389>the <00:23:06.530>u <00:23:06.669>l <00:23:06.810>here, <00:23:06.949>the <00:23:07.090>Etsy <00:23:07.230>host,

361
00:23:09.170 --> 00:23:12.890
<00:23:09.170>because <00:23:09.310>that <00:23:09.450>was <00:23:09.590>one <00:23:09.730>of <00:23:09.870>the <00:23:10.010>permutations <00:23:10.150>that <00:23:10.290>I've <00:23:10.430>added, <00:23:10.570>uh,

362
00:23:12.890 --> 00:23:16.130
<00:23:12.890>that <00:23:13.065>act <00:23:13.240>specifically <00:23:13.415>requested <00:23:13.590>in <00:23:13.765>the, <00:23:13.940>uh, <00:23:14.115>the <00:23:14.290>command.

363
00:23:17.310 --> 00:23:19.810
<00:23:17.310>And <00:23:17.510>if <00:23:17.710>I <00:23:17.909>click <00:23:18.110>on <00:23:18.310>this <00:23:18.510>this <00:23:18.710>year,

364
00:23:19.810 --> 00:23:23.770
<00:23:19.810>all <00:23:19.985>I <00:23:20.159>actually <00:23:20.335>have <00:23:20.510>access <00:23:20.685>to <00:23:20.860>the <00:23:21.034>Etsy <00:23:21.210>host.

365
00:23:24.510 --> 00:23:29.210
<00:23:24.510>So <00:23:24.603>if <00:23:24.696>you're <00:23:24.790>wondering <00:23:24.883>why <00:23:24.976>the <00:23:25.070>Etsy <00:23:25.163>host <00:23:25.256>is <00:23:25.350>considered <00:23:25.443>as <00:23:25.536>a <00:23:25.629>sensitive <00:23:25.723>file <00:23:25.816>for <00:23:25.910>a

366
00:23:29.210 --> 00:23:29.750
<00:23:29.210>key <00:23:29.696>reason,

367
00:23:29.750 --> 00:23:34.410
<00:23:29.750>so <00:23:29.877>it's <00:23:30.004>actually <00:23:30.131>readable <00:23:30.259>only <00:23:30.386>by <00:23:30.513>route <00:23:30.640>or <00:23:30.768>administrators <00:23:30.895>on <00:23:31.022>most <00:23:31.150>systems.

368
00:23:34.750 --> 00:23:38.850
<00:23:34.750>So <00:23:34.877>accessing <00:23:35.004>it <00:23:35.131>could <00:23:35.259>be <00:23:35.386>potentially <00:23:35.513>considered <00:23:35.640>as <00:23:35.768>an <00:23:35.895>elevation <00:23:36.022>of <00:23:36.150>privilege.

369
00:23:39.680 --> 00:23:39.970
Also,

370
00:23:39.970 --> 00:23:44.610
<00:23:39.970>it <00:23:40.110>contains <00:23:40.250>mapping <00:23:40.390>information <00:23:40.530>for <00:23:40.670>local <00:23:40.810>and <00:23:40.950>internal <00:23:41.090>infrastructure <00:23:41.230>that <00:23:41.370>could

371
00:23:44.710 --> 00:23:46.760
<00:23:44.710>add <00:23:45.176>weakness <00:23:45.643>or <00:23:46.110>targeting.

372
00:23:47.790 --> 00:23:52.670
<00:23:47.790>So <00:23:47.897>you <00:23:48.005>can <00:23:48.113>imagine <00:23:48.220>that <00:23:48.328>actually <00:23:48.436>have <00:23:48.543>access <00:23:48.651>to <00:23:48.759>the <00:23:48.866>a <00:23:48.974>c <00:23:49.082>host <00:23:49.190>is

373
00:23:53.040 --> 00:23:57.220
<00:23:53.040>quite, <00:23:53.180>uh, <00:23:53.320>a <00:23:53.460>big <00:23:53.600>one <00:23:53.740>for, <00:23:53.879>for <00:23:54.020>an <00:23:54.159>attacker. <00:23:54.300>So <00:23:54.440>again,

374
00:23:57.220 --> 00:24:01.100
<00:23:57.220>this <00:23:57.360>vulnerability <00:23:57.500>was <00:23:57.640>parts <00:23:57.780>was <00:23:57.920>including <00:23:58.060>in, <00:23:58.200>uh, <00:23:58.340>no <00:23:58.480>jss, <00:23:58.620>uh,

375
00:24:01.100 --> 00:24:06.020
<00:24:01.100>8.5 <00:24:01.187>0.0. <00:24:01.274>So <00:24:01.362>if, <00:24:01.449>if <00:24:01.537>you're <00:24:01.625>still <00:24:01.712>using <00:24:01.800>it, <00:24:01.887>make <00:24:01.975>sure <00:24:02.062>to <00:24:02.149>to <00:24:02.237>grade <00:24:02.324>it <00:24:02.412>not <00:24:02.500>using.

376
00:24:07.560 --> 00:24:08.860
<00:24:07.560>So <00:24:07.754>let's <00:24:07.949>see, <00:24:08.145>some <00:24:08.340>of <00:24:08.534>the <00:24:08.730>learnings,

377
00:24:08.880 --> 00:24:11.700
<00:24:08.880>so <00:24:09.020>to <00:24:09.160>summarize <00:24:09.300>here <00:24:09.440>is <00:24:09.580>some <00:24:09.720>of <00:24:09.860>the <00:24:10.000>learnings <00:24:10.140>we've <00:24:10.280>seen.

378
00:24:11.700 --> 00:24:14.900
<00:24:11.700>That <00:24:11.855>path <00:24:12.011>also <00:24:12.166>actually <00:24:12.322>is <00:24:12.477>quite <00:24:12.633>omnipresent <00:24:12.788>in <00:24:12.944>your <00:24:13.100>code.

379
00:24:15.240 --> 00:24:18.540
<00:24:15.240>So <00:24:15.347>it <00:24:15.455>could <00:24:15.563>be <00:24:15.670>like <00:24:15.778>dependencies <00:24:15.886>on <00:24:15.993>the <00:24:16.101>runtime. <00:24:16.209>This <00:24:16.316>could <00:24:16.424>be <00:24:16.532>on <00:24:16.640>iot,

380
00:24:18.540 --> 00:24:21.820
<00:24:18.540>on <00:24:18.656>routers, <00:24:18.773>uh, <00:24:18.889>you <00:24:19.006>can <00:24:19.123>see <00:24:19.240>that <00:24:19.356>like <00:24:19.473>the <00:24:19.590>dependencies <00:24:19.706>on <00:24:19.823>the <00:24:19.940>vs.

381
00:24:21.820 --> 00:24:25.930
<00:24:21.820>So <00:24:22.053>studio <00:24:22.286>code <00:24:22.520>extension <00:24:22.753>as <00:24:22.986>well. <00:24:23.220>Also,

382
00:24:25.930 --> 00:24:30.130
<00:24:25.930>it's <00:24:26.023>quite <00:24:26.116>easy <00:24:26.210>to <00:24:26.303>confuse <00:24:26.396>the <00:24:26.490>path <00:24:26.583>a <00:24:26.676>p <00:24:26.770>i <00:24:26.863>'cause <00:24:26.956>there's <00:24:27.050>a <00:24:27.143>few <00:24:27.236>functions <00:24:27.330>that

383
00:24:30.150 --> 00:24:34.090
<00:24:30.150>are <00:24:30.250>available. <00:24:30.350>And <00:24:30.450>if <00:24:30.550>you <00:24:30.650>messed <00:24:30.750>up <00:24:30.850>the, <00:24:30.950>uh, <00:24:31.050>the <00:24:31.150>right, <00:24:31.250>the, <00:24:31.350>uh, <00:24:31.450>the <00:24:31.550>order,

384
00:24:35.290 --> 00:24:38.950
<00:24:35.290>you <00:24:35.406>can <00:24:35.523>actually <00:24:35.639>be <00:24:35.756>vulnerable <00:24:35.873>and <00:24:35.990>make <00:24:36.106>your <00:24:36.223>code <00:24:36.340>base <00:24:36.456>vulnerable <00:24:36.573>to, <00:24:36.690>uh,

385
00:24:38.950 --> 00:24:43.930
<00:24:38.950>path <00:24:39.183>reversal. <00:24:39.416>And <00:24:39.650>again, <00:24:39.883>through <00:24:40.116>path <00:24:40.350>reversal,

386
00:24:43.930 --> 00:24:45.370
<00:24:43.930>which <00:24:44.254>means <00:24:44.578>like <00:24:44.902>doing <00:24:45.226>nce,

387
00:24:45.390 --> 00:24:48.850
<00:24:45.390>you <00:24:45.545>can <00:24:45.701>actually <00:24:45.856>chain <00:24:46.012>the <00:24:46.167>vulnerability <00:24:46.323>and <00:24:46.478>this <00:24:46.634>is <00:24:46.790>a,

388
00:24:49.090 --> 00:24:53.010
<00:24:49.090>actually <00:24:49.230>a <00:24:49.370>good <00:24:49.510>doorway <00:24:49.649>in <00:24:49.790>to <00:24:49.929>other, <00:24:50.070>uh, <00:24:50.209>potentially <00:24:50.350>more, <00:24:50.490>uh,

389
00:24:53.410 --> 00:24:55.850
<00:24:53.410>critical <00:24:53.643>exploits, <00:24:53.876>and <00:24:54.110>you <00:24:54.343>can <00:24:54.576>weaponize <00:24:54.810>it.

390
00:24:57.690 --> 00:25:01.710
<00:24:57.690>So <00:24:57.817>the <00:24:57.944>severity <00:24:58.071>of <00:24:58.199>the <00:24:58.326>pet <00:24:58.453>reversal <00:24:58.580>vulnerabilities <00:24:58.708>is <00:24:58.835>compound <00:24:58.962>with <00:24:59.090>insecurely

391
00:25:01.840 --> 00:25:06.700
<00:25:01.840>built <00:25:01.956>application. <00:25:02.073>And <00:25:02.189>this <00:25:02.306>is, <00:25:02.423>goes <00:25:02.540>with <00:25:02.656>the, <00:25:02.773>uh, <00:25:02.889>with <00:25:03.006>chaining <00:25:03.123>those, <00:25:03.240>uh,

392
00:25:06.700 --> 00:25:09.860
<00:25:06.700>those <00:25:06.900>vulnerabilities. <00:25:07.100>So <00:25:07.300>if <00:25:07.500>your <00:25:07.700>application <00:25:07.900>is <00:25:08.100>insecure,

393
00:25:09.860 --> 00:25:13.500
<00:25:09.860>having <00:25:10.000>the <00:25:10.139>pet <00:25:10.280>also <00:25:10.419>will <00:25:10.560>give <00:25:10.699>a <00:25:10.840>bigger, <00:25:10.979>uh, <00:25:11.120>vector <00:25:11.260>of,

394
00:25:13.500 --> 00:25:17.910
<00:25:13.500>of <00:25:13.640>attack <00:25:13.780>for <00:25:13.920>the <00:25:14.060>attackers. <00:25:14.200>So <00:25:14.340>I <00:25:14.480>would <00:25:14.620>like <00:25:14.760>to, <00:25:14.900>uh,

395
00:25:17.960 --> 00:25:20.230
<00:25:17.960>close <00:25:18.240>with <00:25:18.520>this, <00:25:18.800>the <00:25:19.080>augmented, <00:25:19.360>uh,

396
00:25:20.230 --> 00:25:25.070
<00:25:20.230>developer <00:25:20.370>security <00:25:20.510>and <00:25:20.650>to <00:25:20.790>help <00:25:20.930>you <00:25:21.070>also, <00:25:21.210>um, <00:25:21.350>just <00:25:21.490>scanning <00:25:21.630>your,

397
00:25:25.140 --> 00:25:29.030
<00:25:25.140>your <00:25:25.267>codes <00:25:25.394>and <00:25:25.521>see <00:25:25.649>if <00:25:25.776>there's <00:25:25.903>any <00:25:26.030>petrosal, <00:25:26.158>uh, <00:25:26.285>in <00:25:26.412>your <00:25:26.540>code.

398
00:25:29.050 --> 00:25:32.070
<00:25:29.050>So <00:25:29.190>here <00:25:29.330>I'm <00:25:29.470>using <00:25:29.610>the, <00:25:29.750>uh, <00:25:29.889>ID <00:25:30.030>integration <00:25:30.169>from <00:25:30.310>from <00:25:30.450>sny,

399
00:25:32.290 --> 00:25:35.910
<00:25:32.290>and <00:25:32.397>this <00:25:32.505>is <00:25:32.613>the <00:25:32.720>v <00:25:32.828>vs <00:25:32.936>studio <00:25:33.043>code <00:25:33.151>integration. <00:25:33.259>And <00:25:33.366>what <00:25:33.474>I've <00:25:33.582>done <00:25:33.690>here,

400
00:25:35.940 --> 00:25:40.750
<00:25:35.940>I've <00:25:36.095>just <00:25:36.251>copy <00:25:36.406>paste <00:25:36.562>the <00:25:36.717>ST <00:25:36.873>code <00:25:37.028>to <00:25:37.184>vanilla <00:25:37.340>JavaScript,

401
00:25:41.410 --> 00:25:45.510
<00:25:41.410>and <00:25:41.510>then <00:25:41.610>ask, <00:25:41.710>uh, <00:25:41.810>scan <00:25:41.910>actually <00:25:42.010>this, <00:25:42.110>uh, <00:25:42.210>this <00:25:42.310>index <00:25:42.410>do <00:25:42.510>s <00:25:42.610>and <00:25:42.710>you <00:25:42.810>can,

402
00:25:45.530 --> 00:25:47.390
<00:25:45.530>you <00:25:45.705>can <00:25:45.879>see <00:25:46.055>that <00:25:46.230>it <00:25:46.405>actually <00:25:46.580>has <00:25:46.754>been <00:25:46.930>flagged.

403
00:25:47.390 --> 00:25:50.030
<00:25:47.390>There's <00:25:47.670>potentially <00:25:47.950>a <00:25:48.230>petrosal <00:25:48.510>in <00:25:48.790>it.

404
00:25:50.130 --> 00:25:54.590
<00:25:50.130>So <00:25:50.230>if <00:25:50.330>you <00:25:50.430>have <00:25:50.530>tools <00:25:50.630>that <00:25:50.730>actually <00:25:50.830>give <00:25:50.930>you <00:25:51.030>that <00:25:51.130>visibility, <00:25:51.230>uh, <00:25:51.330>please <00:25:51.430>do <00:25:51.530>so.

405
00:25:54.590 --> 00:25:58.030
<00:25:54.590>This <00:25:54.697>is <00:25:54.805>giving <00:25:54.913>you <00:25:55.020>good <00:25:55.128>visibility. <00:25:55.236>And <00:25:55.343>this <00:25:55.451>is <00:25:55.559>also <00:25:55.666>shifting <00:25:55.774>left <00:25:55.882>when <00:25:55.990>you're,

406
00:25:58.030 --> 00:26:01.550
<00:25:58.030>as <00:25:58.137>long <00:25:58.245>as <00:25:58.353>you're, <00:25:58.460>you're <00:25:58.568>coding, <00:25:58.676>you <00:25:58.783>have <00:25:58.891>that <00:25:58.999>kind <00:25:59.106>of <00:25:59.214>feedback <00:25:59.322>in <00:25:59.430>your,

407
00:26:01.690 --> 00:26:05.990
<00:26:01.690>in <00:26:01.772>your <00:26:01.854>id. <00:26:01.937>So <00:26:02.019>this <00:26:02.101>is <00:26:02.184>the, <00:26:02.266>um, <00:26:02.348>the <00:26:02.431>s <00:26:02.513>sneak <00:26:02.595>extension <00:26:02.678>on <00:26:02.760>the, <00:26:02.842>uh, <00:26:02.925>on <00:26:03.007>the <00:26:03.090>id.

408
00:26:07.600 --> 00:26:11.690
<00:26:07.600>Also, <00:26:07.727>just <00:26:07.854>going <00:26:07.981>back <00:26:08.109>to <00:26:08.236>the, <00:26:08.363>um, <00:26:08.490>the <00:26:08.618>vulnerability <00:26:08.745>on <00:26:08.872>the, <00:26:09.000>um,

409
00:26:12.430 --> 00:26:17.010
<00:26:12.430>on <00:26:12.546>the <00:26:12.663>VS <00:26:12.780>code <00:26:12.896>extension, <00:26:13.013>the <00:26:13.130>security <00:26:13.246>team, <00:26:13.363>uh, <00:26:13.480>of <00:26:13.596>SNY <00:26:13.713>actually, <00:26:13.830>um,

410
00:26:17.270 --> 00:26:21.210
<00:26:17.270>did <00:26:17.357>copy <00:26:17.445>the, <00:26:17.532>uh, <00:26:17.620>the <00:26:17.707>code <00:26:17.795>base <00:26:17.882>and, <00:26:17.970>uh, <00:26:18.057>scan <00:26:18.145>it <00:26:18.232>using <00:26:18.320>the <00:26:18.407>S <00:26:18.495>sneak <00:26:18.582>cell. <00:26:18.670>I,

411
00:26:21.210 --> 00:26:23.210
<00:26:21.210>and <00:26:21.365>you <00:26:21.521>can <00:26:21.676>see <00:26:21.832>actually <00:26:21.987>it <00:26:22.143>was <00:26:22.298>flagged <00:26:22.454>with, <00:26:22.610>uh,

412
00:26:23.210 --> 00:26:27.370
<00:26:23.210>high <00:26:23.326>path <00:26:23.443>reversal <00:26:23.560>and <00:26:23.676>medium <00:26:23.793>information <00:26:23.910>exposure. <00:26:24.026>So <00:26:24.143>make <00:26:24.260>sure <00:26:24.376>to, <00:26:24.493>if <00:26:24.610>you,

413
00:26:27.370 --> 00:26:31.170
<00:26:27.370>you're <00:26:27.486>using <00:26:27.603>security <00:26:27.719>tools <00:26:27.836>to <00:26:27.953>have <00:26:28.070>that, <00:26:28.186>uh, <00:26:28.303>that, <00:26:28.419>that <00:26:28.536>usage <00:26:28.653>and <00:26:28.770>visibility.

414
00:26:32.240 --> 00:26:35.290
<00:26:32.240>Also, <00:26:32.347>if <00:26:32.455>you <00:26:32.563>want <00:26:32.670>to, <00:26:32.778>uh, <00:26:32.886>push <00:26:32.993>your, <00:26:33.101>your <00:26:33.209>learning <00:26:33.316>a <00:26:33.424>little <00:26:33.532>bit <00:26:33.640>further,

415
00:26:35.790 --> 00:26:38.450
<00:26:35.790>you <00:26:36.023>can <00:26:36.256>visit <00:26:36.490>the, <00:26:36.723>uh, <00:26:36.956>snicker <00:26:37.190>website,

416
00:26:38.550 --> 00:26:42.410
<00:26:38.550>the <00:26:38.649>free <00:26:38.750>platform <00:26:38.850>where <00:26:38.950>you <00:26:39.050>have <00:26:39.149>those <00:26:39.250>modules <00:26:39.350>just <00:26:39.450>to <00:26:39.550>help <00:26:39.649>you <00:26:39.750>having <00:26:39.850>that <00:26:39.950>kind

417
00:26:42.410 --> 00:26:45.320
<00:26:42.410>of <00:26:42.610>context <00:26:42.810>around <00:26:43.010>those, <00:26:43.210>uh, <00:26:43.410>those <00:26:43.610>vulnerabilities. <00:26:43.810>Uh,

418
00:26:45.320 --> 00:26:48.080
<00:26:45.320>there's <00:26:45.475>one <00:26:45.631>lesson <00:26:45.786>around, <00:26:45.942>uh, <00:26:46.097>the, <00:26:46.253>uh, <00:26:46.408>director <00:26:46.564>to <00:26:46.720>Sal.

419
00:26:48.080 --> 00:26:52.280
<00:26:48.080>It's <00:26:48.196>sent <00:26:48.313>boxes <00:26:48.429>so <00:26:48.546>you <00:26:48.663>can <00:26:48.780>actually <00:26:48.896>type <00:26:49.013>the <00:26:49.129>commands <00:26:49.246>and <00:26:49.363>don't <00:26:49.480>worry,

420
00:26:52.280 --> 00:26:55.720
<00:26:52.280>it's <00:26:52.396>not <00:26:52.513>gonna, <00:26:52.629>uh, <00:26:52.746>it's <00:26:52.863>not <00:26:52.980>actually <00:26:53.096>gonna <00:26:53.213>perform <00:26:53.330>Pet <00:26:53.446>Sal <00:26:53.563>on <00:26:53.680>your,

421
00:26:55.820 --> 00:27:00.810
<00:26:55.820>on <00:26:55.947>your <00:26:56.074>machine. <00:26:56.201>And <00:26:56.329>with <00:26:56.456>that, <00:26:56.583>I <00:26:56.710>would <00:26:56.838>like <00:26:56.965>to <00:26:57.092>thank <00:26:57.220>you,

422
00:27:01.030 --> 00:27:03.450
<00:27:01.030>uh, <00:27:01.170>for <00:27:01.310>that <00:27:01.450>also. <00:27:01.590>Thanks <00:27:01.730>Liran <00:27:01.870>for, <00:27:02.010>uh, <00:27:02.149>for <00:27:02.290>his <00:27:02.430>talk.

423
00:27:03.570 --> 00:27:07.290
<00:27:03.570>I <00:27:03.677>hope <00:27:03.785>you've <00:27:03.893>learned <00:27:04.000>a <00:27:04.108>bit <00:27:04.216>more <00:27:04.323>things <00:27:04.431>around <00:27:04.539>Pat <00:27:04.646>Reversal. <00:27:04.754>Um, <00:27:04.862>and <00:27:04.970>yeah,

424
00:27:07.310 --> 00:27:09.770
<00:27:07.310>may <00:27:07.465>the <00:27:07.621>pat <00:27:07.776>be <00:27:07.932>with <00:27:08.087>you, <00:27:08.243>secure <00:27:08.398>con. <00:27:08.554>Thank <00:27:08.710>you.