Exploiting ORM Vulnerabilities to Leak Sensitive Data: Insights from Almageddon Talk

The talk, titled Almageddon, presented by Alex Brown—a senior security consultant at Elum and contributor to Australia’s largest CTF event—focuses on exploiting object-relational mappers (ORMs) to leak sensitive data beyond intended developer constraints. Over three years, Brown identified a vulnerability class called ORM leaks, where developers unintentionally expose ORM filtering functionality, enabling attackers to traverse relational data and extract passwords, API tokens, or other sensitive fields. Demonstrations included Django’s ORM, where attackers could chain relational filters (e.g., created_by__user__password__startswith) to brute-force password hashes, and BGO (a Go ORM), where a flaw in Harbor’s API allowed bypassing deny-lists to dump user credentials. The talk also covered Prisma (Node.js) and Entity Framework (with OData), highlighting how loose input validation—such as JSON object manipulation in Express.js—could lead to authentication bypasses or data exfiltration via timing attacks. Brown emphasized that ORM leaks are now more common than SQL injection, often resulting in critical-risk vulnerabilities due to overlooked relational exposures. The research was published in blog articles linked during the presentation, with specific bypass techniques detailed for MySQL regex timeouts and case-insensitive collation workarounds.