Top 10 winner

Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out

Breaking Parser Logic! Take Your Path Normalization Off and Pop 0days Out

Orange Tsai · Black Hat

Servers, frameworks and reverse proxies normalise URL paths differently, so a segment such as /..;/ or an encoded traversal is read one way by the front proxy and another by the Java backend. The mismatch bypasses proxy ACLs and context mapping to reach management consoles and chain into remote code execution, and produced 0days in Spring, Rails, Spark and Jenkins.

Record

Document

Breaking Parser Logic! Take Your Path Normalization Off and Pop 0days Out

Researcher

Orange Tsai

Published by

Black Hat

Format

Slides

Topic

Other

In the archive

• Ranked #1 in the 2018 Top 10 Web Hacking Techniques

Related sources

• DEF CON 26 - Orange Tsai - Breaking Parser Logic Take Your Path Normalization Off and Pop 0Days Out

Tags

• path-traversal
• parser-differential
• reverse-proxy
• url-parsing
• auth-bypass
• rce
• java
• spring
• rails
• attack-chain
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Orange Tsai, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 September 2026.