BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//orangecon-2024//speaker//MKLPFH
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-orangecon-2024-YZRPBK@pretalx.com
DTSTART;TZID=CET:20240905T154500
DTEND;TZID=CET:20240905T162500
DESCRIPTION:Apache HTTP Server\, as a cornerstone of the entire World Wide 
 Web\, accounts for about one-third of the web server market share worldwid
 e. It's not an overstatement to say that its security is synonymous with t
 he security of the Internet. However\, while delving into the source by ch
 ance\, we discovered that the coding style of this open-source project see
 med a little bit... open? This research was thus born!\n\nThe Apache Httpd
  is comprised of dozens of different modules\, which are coupled together.
  When a new HTTP request arrives\, all modules uphold and maintain a colos
 sal structure\, collaborating in harmony to complete the request. While th
 is cooperation might sound ideal\, the reality reveals a significant chall
 enge: the modules are not entirely familiar with each other\, especially r
 egarding the implementation details. However\, they are asked to collabora
 te to fulfill the task. If any module has an incorrect understanding of an
 y fields of this huge structure\, it could potentially lead to fatal issue
 s.\n\nThis observation led us to focus on interactions between modules\, a
 nd discover this new attack surface. Let's see how a seemingly harmless st
 ructure modification can be passed through layers\, amplifying the impact 
 and affecting other modules to become vulnerabilities. This novel attack s
 urface unearthed 3 distinct types of Confusion Attacks and 8 vulnerabiliti
 es\, which allow us to navigate easily between Httpd modules\, generating 
 various attacks based on the different functionalities of modules: from th
 e simplest arbitrary source code disclosure to misinterpreting a normal im
 age as malicious scripts\, bypassing ACL\, and enabling unlimited SSRF. Of
  course\, we won't forget about RCE\, we will demonstrate how a long-under
 estimated bug type can be transformed into code execution by leveraging Ht
 tpd's internal features!\n\nBy understanding this talk\, attendees won't b
 e surprised at how we've managed to teach an old dog new tricks. Developer
 s will understand how to avoid writing problematic Httpd modules. Server A
 dmins can utilize this knowledge to examine their sites for potential vuln
 erabilities\, and security researchers are able to explore more hidden iss
 ues along this direction. It's a scenario where everyone wins!
DTSTAMP:20260713T181751Z
LOCATION:Main track
SUMMARY:Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache H
 TTP Server! - Orange Tsai
URL:https://pretalx.com/orangecon-2024/talk/YZRPBK/
END:VEVENT
END:VCALENDAR