DataBinding2Shell: Novel Pathways to RCE Web Frameworks

DataBinding is a mechanism that allows request parameters to be bound to a domain object automatically. It makes development more efficient and code cleaner, and is widely implemented by best web frameworks written in trending programming languages, including Java, JavaScript, Groovy, Python and Ruby.The previous research related to DataBinding mainly focuses on Mass Assignment[1], which is caused by improper use of DataBinding. This occurs when a user is able to access a sensitive field of domain object such as salary, …

access application code development domain flag frameworks java javascript languages novel object programming python rce request research ruby salary security web web frameworks