o0o: July 2010

I don't know ruby, but I read about the rails bug this week. It reminded me of @meder's awesome work on OGNL in Struts

Update Mon Aug 2 2010: Turned out JBoss didn't release fix for the community version at seamframework.org , though fix has been committed to the svn. Update Mon Aug 11 2010: 2.2.1CR2 is released fixing this vulnerability. Here's interesting bug I found in JBoss Seam Framework, which led to remote code execution using JBoss EL expressions. Having any sort of custom expression language in a web framework is always a sign of potential vulnerabilities (see CVE-2010-1870 for another example of expression language vulnerability), since framework developers will try to add support for that expression language to various components, and some of those components may in turn handle user-controlled inputs without developers realizing it.

Full article: http://blog.o0o.nu/2010_07_01_archive.html