Top 10 winner
Parser Differentials: When Interpretation Becomes a Vulnerability
OffensiveCon25 - Joernchen - Parser Differentials: When Interpretation Becomes a Vulnerability
Two parsers read the same document differently: duplicate JSON keys, and YAML local versus global binary tags, make a validator and the consumer disagree. One crafted file looks benign to a scanner, ingress or auth layer while the backend takes attacker-controlled values, yielding IaC scanner evasion, JWT auth bypass and a GitLab devfile bypass with arbitrary file write.
Record
- Document
- OffensiveCon25 - Joernchen - Parser Differentials: When Interpretation Becomes a Vulnerability
- Researcher
- Joern Schneeweisz
- Published by
- 0day.click
- Date
- Format
- Recording
- Topic
- Injection
In the archive
Related sources
- Parser Differentials: When Interpretation Becomes a Vulnerability
- OffensiveCon25 - Joernchen - Parser Differentials: When Interpretation Becomes a Vulnerability
Tags
This page is the archive's own catalogue record. The research is the work of Joern Schneeweisz, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .