Hacking The Edge: Real-World ESI Injection Exploits

Okay, hello everyone. Thank you. Thank you for coming. So I'm going to present Hacking the Edge: Real-World ESI Injection Exploits. First of all, a little bit about me. Right now, I'm working as a Senior Security Engineer at UAPAD, which is a fantastic company. I've I'm also doing I've been doing bug bounty hunting for the past five years. I'm in the Hall of Fame of PayPal, Amazon, and Epic Games, and I'm I actually like walking a lot. I like Brazilian Jiu-Jitsu. And that's all that's a lot of introduction about me.

Okay, let's talk about Edge Side Includes (ESI). Basically, these are just HTML-style tags that CDN or proxy swaps for live snippets. And it helps you it helps you put dynamic content, dynamic bits into cached pages. At least that's the intended way to use this. And this is basically an alternative, an old alternative, to using things like Ajax or Server Side Includes. So that this is the syntax. Whenever you see this, it's it's quite a good hint that the company is not parsing them right or you can actually hunt for the hunt for those in the page source. And it basically looks like this. So let's say you have the e-commerce site and you want to dynamically include your shopping cart, you can use it. You can use the ESI include or this is actually a real example from a site I've been testing. They have that variable. They have a geo country variable and they use a query string. It's and all of this just to make it available in the JavaScript, to make the country available, make the region name available, so they can use it for different types of parsing.

[02:00]

Okay. So I've actually started looking into these types of bugs because of Sudi. So he basically contacted me on Twitter and it was fantastic. He basically came up with he was at the start of bug bounty hunting in his hunting journey and he was like, "I this guy hunts in this program that I want to find vulnerabilities and I found this problem. I found something interesting here and it also has a bonus. So, do you want to collaborate?" And I thought it was fantastic that someone just comes up to you and I think we've been talking for the last three years and it's an incredible collaboration to have just online, just people reaching up to you. So, I'll go over a few of the vulnerabilities that we found. First of all, we found this endpoint. We found this endpoint which if you look closely, you're going to see from the in from the input parameter, from the input value, you have an ESI here, but this gets rendered in the output. So you're going to have the x6yyyy without the ESI tag because basically whatever was inside the ESI tag, it should be right here, should be rendered. So the ESI tag is practically stripped, and you can test for that because sometimes