Re:Exploiting URL Parser in Programming Languages (2017) [pdf]
by jsjohnst on Monday September 10, 2018 @11:58PM
(#17957084)
> but wouldn't prevent it from being made to make requests to other outside services.
But could be done via host firewall rules to some extent.
Re:Exploiting URL Parser in Programming Languages (2017) [pdf]
by Kalium on Tuesday September 11, 2018 @03:51AM
(#17957877)
Very true! Firewall rules with a strict filter could contain this!
Of course, that assumes you're not doing something like running in AWS and using the AWS firewall. And that your firewall never has any issues at all.
In general, defense in depth is a preferable strategy. Your entire defense should never be reliant upon a single control.
Re:Exploiting URL Parser in Programming Languages (2017) [pdf]
by jsjohnst on Tuesday September 11, 2018 @08:22AM
(#17959027)
> Your entire defense should never be reliant upon a single control.
Exactly why I used “to some extent” as a suffix to the statement. One tool alone doesn’t necessarily make you safe, but it might be enough for practical purposes depending on your risk profile.
This would at least prevent it from attacking your own internal services but wouldn't prevent it from being made to make requests to other outside services. Effectively leaving you up as a potential proxy for other attacks. I.e. the SMTP TLS stuff, making you able to send spam on someone else's behalf. A bit nuts.