Kirill Firsov
@k_firsov
Co-founder and CTO of @FearsOff | Protecting the World’s Top Crypto Exchanges & Financial Institutions | Cybersecurity Enthusiast
452 Following 10.4K Followers
php2shell
Tomorrow is a helluva day.
We found a gadget-free RCE in Fastjson 1.2.83 - the final release of the 1.x line, and still one of the most widely-deployed Java JSON libraries in production today, even with 2.x around.
No classpath gadget. One payload-> RCE.
Show more
