https://peertube.eqver.se/videos/watch/2de28b91-3633-4c69-a689-fc1507e7463b A DEF CON 30 talk on reverse engineering SAP’s proprietary HTTP server and exploiting critical vulnerabilities CVE-2022-22536 and CVE-2022-22532. The presentation demonstrates how a remote, unauthenticated attacker can compromise SAP installations worldwide. The talk explores Advanced Response Smuggling techniques to desynchronize internal buffers and hijack user sessions — even without a proxy. It also covers exploitation of a Use-After-Free vulnerability in the Inter-Process Communication (IPC) mechanism, enabling manipulation of messages belonging to other TCP connections through cache poisoning and response splitting. Finally, it shows how corruption of IPC buffers and pointers can escalate into full remote code execution (RCE). Fri, 24 Jul 2026 11:35:48 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://peertube.eqver.se https://peertube.eqver.se/client/assets/images/icons/icon-512x512.png https://peertube.eqver.se/videos/watch/2de28b91-3633-4c69-a689-fc1507e7463b All rights reserved, unless otherwise specified in the terms specified at https://peertube.eqver.se/about and potential licenses granted by each content's rightholder.