Take Your Path Normalization Off and Pop 0days Out

Take Your Path Normalization Off and Pop 0days Out

Explore path normalization vulnerabilities and their exploitation in this conference talk from Hack.lu 2018. Delve into various case studies, including Nginx off-by-slash failures, Spring and Rails 0days, and RCE vulnerabilities in Uber and Amazon. Learn about polyglot URL paths, spotting vulnerabilities, and techniques for finding these issues. Examine the dangers of reverse proxy interactions, ACL bypasses through inconsistencies, and authentication bypasses via misconfigurations. Discover how log injection can lead to RCE and how code reuse bugs can result in Expression Language injection. Gain insights into mitigation strategies and summarize key takeaways for improving web application security.