Legacy Archive Page
A static article list retained for compatibility with legacy pagination URLs.
0x01 Preface On Tuesday, March 1, Spring published its Spring Cloud Gateway CVE report. CVE-2022-22947 was rated Critical. Analyses appeared Wednesday and Thursday, but work and thesis writing delayed my review. I reproduced and analyzed it over the weekend…
An article written last year but never published, now shared as both WeChat content and personal notes. Preface Since Fastjson 1.2.24's deserialization vulnerability was disclosed on March 15, 2017, it has been a major research target. Even checkAutoType did not fully stop new vulnerabilities. This article examines one through Xuanwu Lab's Black Hat talk…
Preface A tweet last night attracted considerable attention in the security community. Log4j 2.17.0 has RCE!! Yet the community mostly scoffed: RCE after modifying a configuration file—is that all? So how did configuration-file RCE become fashionable? The story begins…
0x01 Preface While following up on Log4j 2, I found several interesting details and recorded them here. 0x02 Is Log4j Never Vulnerable to JNDI Injection? First, a question: is Log4j never vulnerable to JNDI injection? No. I found an interesting exchange in a Log4j 2 pull request. Someone argued that Log4j is vulnerable…
0x01 Preface. December 9, 2021 became a sleepless night when Apache Log4j was found vulnerable to a simple, high-impact RCE. Countless components depend on Log4j2, apart from the risks in applications themselves. A Maven Repository search for projects using log4j-core 2.14…
0x01 Preface Some time ago I finally wrote Principles and Case Study of File Inclusion, which mentioned Thymeleaf SSTI. Yesterday Sanmeng shared a newly discovered Thymeleaf SSTI bypass CVE. Since my project code was still available, I analyzed it. 0x02 Thymeleaf SSTI Thymeleaf…
0x00 Preface. I created this series because online Java code-audit material is usually fragmented and unfriendly to beginners. I am also learning Java auditing, so the series records and summarizes that process. It is intended for readers with basic Java syntax knowledge and will cover…
0x01 Preface Every note in this series is based on Understanding JVM Bytecode in Depth by Zhang Ya and is intended only as a personal study summary. Readers studying Java security or JVM bytecode are strongly encouraged to purchase and read the official book. 0x02 Class-File Structure Java is cross-platform, although the JVM itself is platform-specific. JVM implementations hide those platform differences by compiling source code into platform-independent bytecode, so…
About this book. I finished writing it last December. The seven months from revision to publication were a long and demanding journey. The book is well suited to beginners and expands both the breadth and depth of my Java Code Auditing for Beginners article series—which is also why that series had not been updated for so long. If you want to learn Java code auditing, consider picking up a copy. Purchase link: https://item.jd.…
0x01 Preface The native JDK 8u20 deserialization vulnerability is a classic and one of the most complex vulnerabilities I have analyzed. It uses substantial low-level knowledge and assumes familiarity with the deserialization process and serialized-data structure. This article reflects my own understanding; please point out any inaccuracies. 0x02 JDK 8u20 Vulnerability Principles JDK…