Java Authentication and Authorization Service (JAAS) - A Novel Attack Surface

This Black Hat conference talk explores the security vulnerabilities within Java Authentication and Authorization Service (JAAS), a widely-used Java framework for authentication and authorization. Discover how security researchers from Alibaba Cloud uncovered a novel attack surface they've termed "JAAS Attack," which extends beyond the 2023 JNDI injection vulnerability found in Kafka. Learn about their comprehensive analysis of popular Java libraries that revealed numerous vulnerabilities affecting major vendors including Amazon, Cloudera, IBM, and Microsoft. The presentation details how these vulnerabilities can be exploited in real-world scenarios to achieve Remote Command Execution (RCE), demonstrates why Kafka's fix solution remains insecure, and provides security design principles for safely integrating JAAS into Java libraries. Gain valuable insights to broaden your security research perspective and develop skills to identify new attack surfaces in Java applications.