Attacking JSON - Vulnerabilities in Popular Parsers

Explore the security vulnerabilities in JSON parsers and other serialization formats in this 41-minute conference talk from AppSecUSA 2017. Delve into the aftermath of the 2016 Java deserialization apocalypse and examine why JSON, often recommended as a safer alternative, may still be susceptible to Remote Code Execution (RCE) attacks. Analyze popular JSON parsers in both .NET and Java, identifying potential RCE vectors and vulnerable configurations. Expand your understanding to other serialization formats, with a particular focus on .NET. Discover new vulnerable formats and learn about stable RCE gadgets in system libraries. Gain valuable insights on assessing code vulnerability, implementing remediation strategies, and exploring alternative approaches to enhance security in serialization processes.