Samuel Erb and Justin Gardner: Crossing the KASM — A Pentest Story
A DEF CON 30 talk about how a seemingly hardened bug bounty target — KASM Workspaces, an enterprise Docker-based VDI solution — was ultimately compromised. At first, the target appeared nearly untouchable: no source code, no obvious vulnerabilities, tightly secured architecture. But after reversing Python binaries, the real hunt began.
The speakers walk through the full exploit chain: NGINX configuration injection via the Host header, filter bypass using ISO-8859-1 encoding, SSRF → LFI → extraction of KASM Agent secrets → command execution as root inside Docker and eventual breakout to the host.
The speakers walk through the full exploit chain: NGINX configuration injection via the Host header, filter bypass using ISO-8859-1 encoding, SSRF → LFI → extraction of KASM Agent secrets → command execution as root inside Docker and eventual breakout to the host.