Update writeups.csv

[onmywaytoheaven]

trafficstars

Hey, could you please merge my pull request?

[NDevTK]

Interesting attack although an API should not be running untrusted code it would seem more useful to block usage of eval to prevent code execution in the first place. Of course this could be an edge case where the API endpoint is not sensitive, yay defense in depth.

[onmywaytoheaven]

Thanks for the feedback @NDevTK !

You are absolutely right that APIs shouldn’t be running untrusted code. In Apigee, the code executed in a JavaCallout policy is isolated using JDK security features, as detailed here. Similarly, code in a JavaScript policy is sandboxed through the mechanisms provided by the Rhino JavaScript engine as I described in the blog post.

The tricky part and what makes this interesting is when an object is passed from Java to JavaScript. If that object tries to perform an action that would normally violate permissions in the JavaCallout policy (and thus throw a security exception), it can still be executed within the JavaScript policy, bypassing those restrictions

[NDevTK]

Nice find :)

[staz0t]

Cool bugs!