Java RMI services often vulnerable to SSRF attacks – research

guest · Jan 6, 2022

January 6, 2022

Java RMI services can be attacked through server-side request forgery (SSRF) attacks, according to a detailed analysis of the problem by security researcher Tobias Neitzel.

Java RMI is an object-oriented Remote Procedure Call (RPC) mechanism available in most Java installations. Software developers can use the technology to make functions available over a network.
For communication, Java RMI relies on serialized Java objects – a mechanism that attackers are often able to target, despite the fact that the technology has gone through a process of hardening and tempering over recent years, Neitzel discovered.
Click to expand...

In a detailed technical blog post, the researcher explains how default RMI components can be attacked to variable outcomes. Potential outcomes can result in remote code execution, Neitzel told The Daily Swig.

“As with all SSRF techniques, the major problem is that attackers may be able to attack RMI services that are supposed to only be accessed from trusted networks,” Neitzel explained.
Click to expand...

The most commonly used RMI service is JMX. Neitzel showed it was possible to compromise a backend JMX service via SSRF, but only providing the system returns responses from the backend service and accept arbitrary bytes within them.

Similarly, SSRF-based attacks on default RMI components, such as the RMI registry, are also possible, though only where the system allows arbitrary bytes to be sent to the backend service.
Click to expand...

Attacking Java RMI via SSRF

During the last couple of years, SSRF vulnerabilities have become more and more popular and several high impact vulnerabilities have been identified. Possible targets in the backend range from HTTP based services like Solr, over cloud metadata services, up to more exotic targets like redis databases. In this blog post we discuss the SSRFibility of Java RMI and demonstrate how RMI services can be targeted via SSRF.
Click to expand...

Log in or Sign up

Java RMI services often vulnerable to SSRF attacks – research

guest Guest

Log in or Sign up

Java RMI services often vulnerable to SSRF attacks – research

guest Guest

Useful Searches