Top 10 winner
ORM Leaking More Than You Joined For
ORM Leak attacks let a user who controls a filter expression search sensitive columns such as password hashes or reset tokens character by character. This instalment bypasses Harbor's patches via an expression-parsing quirk, turns Prisma type confusion into an authentication bypass, and shows Entity Framework and OData filtering leaking the same way.
Record
- Researcher
- Alex Brown
- Published by
- elttam.com
- Topic
- Other
In the archive
Related sources
- Black Hat EU briefing
- plORMbing your Prisma ORM with Time-based Attacks
- ORM leak detection rules
- Plormber exploitation tool
Tags
This page is the archive's own catalogue record. The research is the work of Alex Brown, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .