DEF CON 32 - Relative Path File Injection The Next Evolution in RPO - Ian Hickey
Source: YouTube · DEFCONConference · published Oct 16, 2024 · 29:13
The video introduces relative path file injection, a new security vulnerability that builds on the 2014 discovery of relative path overwrite, enabling attackers to execute code through lenient file parsers when servers mishandle path navigation 0:57-1:12.
Key Takeaways:
• Lenient parsers like PDF, shell scripts, and server-side languages can execute code even when embedded within HTML content, as they ignore surrounding HTML until they find interpretable content 4:53-5:16.
• By adding a forward slash to the end of URLs, attackers can exploit vulnerable servers to return HTML pages containing injected file content instead of the intended file download 9:01-9:29.
• PDF files are particularly dangerous vectors because they can contain JavaScript that executes shell commands, potentially allowing full system compromise 11:24-11:52.
• The vulnerability also affects modern HTML-over-the-wire frameworks like HTMX and Livewire, which dynamically inject server-provided HTML content 15:00-15:31.
• Shell scripts on Windows (WSL2, PowerShell) and some Linux distributions will execute HTML-injected commands, ignoring HTML lines until reaching recognizable script content 18:01-18:22.
Mitigation strategies include using base tags, implementing content security policies, and avoiding relative paths in file downloads 25:04-25:31.
Sources:
- 0:57-1:12 Explanation of relative path overwrite origins
- 4:53-5:16 Introduction to lenient parsers concept
- 9:01-9:29(https://www.youtube.com/watch?v=3y_6o
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
so it is my pleasure to welcome Ian hickey to the stage talking about relative path file injection the next evolution in relative path hot de right okay let's give it [Applause] up thank you for having me today at the Abc Village Defcon 32 thank you for having appc Village here as well uh I'm a software developer uh I don't work in security I work in edtech but every once in a while I like to spend some brain power looking at some security things and the last time I was doing this in April or May I had a couple of um discoveries that I thought were interesting and I'm going to share them with you today so many of you know that there's something called relative path overwrite uh that was discovered in 2014 by Gareth Hayes of Port swiger research and relative path overwrite is a way to uh if…