Comment by tptacek
15 hours ago
I think this is just false? Are we playing some kind of weird game of telephone? Is the term "direct exploit" doing way more work in that sentence than you mean it to?
15 hours ago
I think this is just false? Are we playing some kind of weird game of telephone? Is the term "direct exploit" doing way more work in that sentence than you mean it to?
The alternative route through the web forms requires the absence of ASLR. So you need to spam the endpoint, like a lot. You can probably mitigate at the edge (CDNs) or perhaps at the reverse proxy level (NGINX) through e.g. rate limiting. More of a web version of row hammer then some sort of trivial SQL injection attack that works consistently.
Maybe a LAMP stack on an extremely ancient version of Linux is vulnerable out of the box. Quit the fear mongering please, you do the security community no favors.
so confident so completely incorrect
educate yourself
https://oliviagallucci.com/aslr-bypass-techniques-and-circum...
[flagged]
1 reply →