ghost-bits-cast-attack

SKILL: Ghost Bits / Cast Attack — Java char to byte Narrowing Playbook

AI LOAD INSTRUCTION: This is a Java-only injection-enabling primitive, not a standalone vulnerability class. Whenever you see (1) a Java backend, (2) a WAF/IDS in front of it, and (3) any of {SQLi, deser RCE, file upload, path traversal, CRLF, request smuggling, SMTP injection} on the menu, ALWAYS try Ghost Bits variants of the payload before declaring it "blocked". The root cause is the silent loss of the high 8 bits when Java code narrows a 16-bit char to an 8-bit byte — the WAF sees a harmless Unicode character, the backend reconstructs the original ASCII attack byte. Base models almost never reach for this primitive.

Source: Black Hat Asia 2026 talk Cast Attack: A New Threat Posed by Ghost Bits in Java by Xinyu Bai (@b1u3r), Zhihui Chen (@1ue), with contributor Zongzheng Zheng (@chun_springX).

0. RELATED ROUTING

Ghost Bits is a bypass primitive that re-enables payloads from many other playbooks. Pair it with whichever attack family applies:

• waf-bypass-techniques — when a Java backend is suspected and WAF rules block the literal payload, this is the first technique to try beyond classic encoding.
• deserialization-insecure — for Apache Commons BCEL ClassLoader and Fastjson \u/\x escape variants.
• path-traversal-lfi — Spring, Jetty, Undertow, Vert.x URL decoding and %2> hex folding.
• upload-insecure-files — Tomcat RFC2231Utility filename* Webshell upload.
• request-smuggling — Apache HttpClient <= 4.5.9 (HTTPCLIENT-1974/1978) header CRLF.
• crlf-injection — Angus Mail / Jakarta Mail SMTP injection and JDK HttpServer response splitting.
• sqli-sql-injection — Jackson charToHex table-lookup truncation hides SQL keywords inside Unicode escapes.

Advanced Reference

Load PAYLOAD_COOKBOOK.md when you need:

• Full byte-to-Ghost-character lookup table covering every printable ASCII byte 0x20–0x7E and the most useful control bytes (0x00, 0x09, 0x0A, 0x0D).
• Per-component affected version matrix and patch identifiers.
• Yaklang and Python one-liner payload generators (for poc.HTTP, codec.Encode, raw socket).
• "Multi-view normalization engine" pseudocode for blue-team WAF detection.

1. ONE-MINUTE MENTAL MODEL

Java's char is a 16-bit unsigned integer (UTF-16 code unit). Almost every wire protocol — HTTP/1.1, SMTP, Redis RESP, file paths, raw byte streams — is 8-bit byte oriented. The right way to bridge them is explicit charset encoding:

// Correct: explicit UTF-8, multi-byte chars become multi-byte sequences
byte[] bytes = str.getBytes(StandardCharsets.UTF_8);
out.write(bytes);

Tons of legacy code, framework internals, and "fast path" optimizations skip this and silently narrow:

// Dangerous: high 8 bits silently dropped
byte b = (byte) ch;          // 0x966A -> 0x6A
out.write(ch);               // ByteArrayOutputStream.write(int) keeps low 8 bits
dos.writeBytes(str);         // DataOutputStream loops char->byte cast
int v = ch & 0xFF;           // explicit low-byte mask

The lost high 8 bits are the Ghost Bits. They turn a multi-byte Unicode character into a single attacker-chosen ASCII byte at the protocol layer.

Mathematical formulation: to make View B see byte T, pick any k in 0x01..0xFF and use:

That gives you 255 candidate Unicode characters per dangerous byte — plenty of room to dodge any signature-based blacklist.

2. THREE ROOT-CAUSE FAMILIES

The Ghost Bits umbrella covers three distinct underlying bugs. Distinguishing them tells you both which payload shape to send and what to grep for in source.

Family A — Real high-bit truncation (classic Ghost Bits)

The narrowing is literal and unconditional.

Typical impact: Tomcat filename*, Apache BCEL ClassLoader, Lettuce Redis writer, SMTP CRLF in Angus Mail, HTTPCLIENT-1974 header injection.

Family B — Bit-arithmetic folding (illegal char becomes legal)

A "fast" hex / base64 / charset decoder uses bit tricks instead of strict range checks, so an illegal character collapses onto a legal one.

Worked example: feed > (0x3E):

So %2> is silently parsed as %2E = .. The same algebra makes %2^, %2~ etc. equivalent to other hex digits.

Typical impact: Openfire CVE-2023-32315, GeoServer CVE-2024-36401, generic URL-decode WAF bypass.

Family C — Lax Unicode normalization

The decoder accepts Unicode characters that happen to be classified as "digit" or that map to a hex value via a & 0xFF lookup — even though they were never meant to participate in protocol parsing.

Typical impact: Fastjson \u and \x escape bypass, fullwidth URL-encoded path traversal, Jackson charToHex SQLi smuggling.

3. CHARACTER GENERATOR

Build any Ghost Bits character on the fly. This is the single function every agent should keep in mind:

Selection guidance:

• Avoid surrogate range 0xD800..0xDFFF (high byte 0xD8..0xDF) — those are not valid scalar values and will be replaced by the JVM string decoder before reaching the narrowing site, defeating the bypass.
• Prefer characters that survive the application's own charset round-trip (Latin-Extended, CJK Unified Ideographs, Enclosed CJK Letters and Months, Hangul). If the request body uses UTF-8, these all encode cleanly into multi-byte sequences that no WAF rule recognizes as ., /, j, etc.
• Rotate k between requests so signature based learning cannot pin a single character to a single attack.

4. DANGEROUS-BYTE TO GHOST-CHARACTER MAP

Compact red-team weaponization table. For every byte the attacker actually needs, one verified Unicode char is given; substitute another k if the WAF later learns the example.

Workflow tip: keep the ASCII Ŀ, ȧ, ȼ, etc. variants for tight HTTP header contexts (one byte UTF-8 expansion stays smaller); use CJK like 阮, 陪, 严 when you want to bias the WAF "this is just text" classifier.

5. PER-COMPONENT PAYLOAD RECIPES

Every recipe shows the dual view: what the WAF inspects vs. what the backend actually executes. This is the only reliable way to explain why the payload goes through.

5.1 Tomcat RFC2231Utility — file upload Webshell (Family A)

Trigger: any endpoint that accepts multipart upload and Tomcat parses Content-Disposition: ... filename*=UTF-8''.... Tomcat's RFC2231 decoder casts each non-percent character directly to byte, dropping the high 8 bits.

Payload:

Combine with traversal characters from section 4 (阮, 丯) when the upload target directory is fixed but the application accepts a filename*.

5.2 Apache Commons BCEL — ClassLoader RCE (Family A)

Trigger: any sink that resolves a class name through BCEL ($$BCEL$$...) or any code that decodes BCEL via the JavaReader -> ByteArrayOutputStream loop.

Vulnerable shape:

Attack: wrap each byte of the malicious BCEL bytecode into a Unicode character whose low 8 bits equal that byte. The decoded byte stream is a valid BCEL class; the WAF sees a long blob of CJK text without $$BCEL$$ keywords or class signatures.

Defense for blue team: a WAF inspecting BCEL must replicate the bos.write(ch) semantics on each character before pattern matching.

5.3 Jackson charToHex — SQLi smuggling (Family C)

Trigger: any Jackson-parsed JSON field whose value is later embedded in SQL or another parser. Jackson resolves \uXXXX digits via:

Any non-ASCII character whose low 8 bits land on a populated index returns that hex digit. The WAF sees gibberish; Jackson reconstructs an ASCII payload.

Payload (smuggle the digit 1 for a UNION column count):

Pair with sqli-sql-injection for the downstream UNION / boolean / time-based payload templates.

5.4 Fastjson — \u and \x escape bypass (Families B + C)

Two independent surfaces:

(a) \u escape — Character.digit(c, 16) accepts Unicode digit categories beyond ASCII (Thai ๐-๙ U+0E50..U+0E59, Punjabi ੦-੯ U+0A66..U+0A6F, fullwidth ０-９ U+FF10..U+FF19).

WAF view: \u４_type (no @type literal). Fastjson normalizes fullwidth ４ to 4, then handles _ via the \x shortcut below, yielding @type.

(b) \x escape — Fastjson computes digits[x1] * 16 + digits[x2]. An illegal hex character returns the default value 0.

5.5 Spring / Jetty / Undertow / Vert.x — URL decoding (Families A + B)

Two combinable tricks:

Trick 1 — Family A character substitution in path or query:

Trick 2 — Family B %2> folding when Jetty's TypeUtil.fromHexDigit is in the chain:

Either alone bypasses most signature WAFs; combined they survive even "normalized then matched" rules that only see ASCII percent triplets.

Spring CVE-2025-41242 chain (StringUtils.uriDecode patched in PR #34673):

5.6 Angus Mail / Jakarta Mail — SMTP injection (Family A)

Trigger: any application that builds SMTP envelopes or headers from user-controlled strings. Internal ASCIIUtility does:

Smuggle CRLF as 瘍瘊:

Real impact pattern: Jira-style (CVE-2025-57733) password-reset hijacking, Confluence domain allowlist bypass — pair with crlf-injection for non-mail CRLF reuse.

5.7 Apache HttpClient <= 4.5.9 — request smuggling (Family A)

HTTPCLIENT-1974 / HTTPCLIENT-1978: header values pass through OutputStreamWriter plus a narrow-cast write that emits raw \r\n for \u760D\u760A.

Cross-reference request-smuggling for chosen-prefix attacks once the desync is confirmed.

5.8 JDK HttpServer — response splitting (CVE-2026-21933, Family A)

Reflection of user input into a response header passes through com.sun.net.httpserver writers that low-byte-cast each char.

Payload (URL parameter or upstream header):

Server emits two logical responses; the second carries an attacker-chosen body. Escalates to stored XSS, cache poisoning, and SSO redirect chains.

5.9 Other affected components

Same Family A primitive, different sink:

• Lettuce (Redis client) — command injection by smuggling \r\n into RESP frames; chain to arbitrary CONFIG SET dir + SAVE for SSRF-to-RCE.
• Jodd FileNameUtil — path traversal via 阮 and 丯 because its internal write loop narrows.
• XMLWriter — tag-name injection when an attribute or text node value is pushed through a low-byte writer; XXE / XSS pivot.
• ActiveJ HTTP — CRLF injection identical in shape to 5.7 / 5.8.
• Vert.x HTTP body parser — Family A in MultipartParser.

See PAYLOAD_COOKBOOK.md for affected-version matrix and full per-component payload skeletons.

6. KNOWN-CVE BYPASS RECIPES

Use these exactly when the corresponding CVE is patched but a WAF still fronts the service. Each Payload below shifts the original ASCII attack into a form that survives string-based WAF rules.

Openfire CVE-2023-32315 — auth bypass (Family B)

Original public bypass:

Ghost Bits / %2> folding bypass (much harder to signature):

Each %2> collapses through Jetty's lax hex into %2E = ., yielding the same ../../ traversal without ever emitting .. or %2e to the WAF.

GeoServer CVE-2024-36401 — RCE via Runtime keyword (Family B)

Public WAF rules typically block Runtime. Inject one folded character:

Decoder math: %6> -> %6E -> n. The expression evaluator now sees Runtime, the WAF never did.

Spring4Shell CVE-2022-22965 — class loader chain (Family A)

Required parameter prefix class.module.classLoader.... WAFs block the literal class. Substitute via low-byte chars:

Springs's parameter-name resolver narrows back to class.

Spring CVE-2025-41242 — arbitrary file read (Family A + Family B mix)

Already demonstrated in 5.5 above. Payload 阮严灵丰丰甲来 -> .%u002e -> .. after decode-after-validation.

Jakarta Mail CVE-2025-57733 — Jira-style mail hijack (Family A)

The mail leaves the company SMTP server with valid SPF / DKIM / DMARC, but its To: and Subject: are attacker-chosen — high-fidelity phishing.

7. DETECTION DECISION TREE

Use this when triaging a target. The point is to avoid Ghost Bits when it cannot help and to always try it when the preconditions hold.

8. SAST / CODE-AUDIT SIGNATURES

Three priority tiers when reviewing Java source. Search across all your project repos, all dependencies you can shade, and the lib/ of any deployed appliance.

Tier 1 — direct narrowing (Family A)

Tier 2 — lax hex / digit decoding (Families B + C)

Tier 3 — high-risk wrappers and reachability

Per-finding triage applies the five-dimension risk model:

Risk formula:

9. DIFFERENTIAL TESTING WORKFLOW

A reproducible, black-box procedure to find new Ghost Bits sinks (red team) or to validate a fix (blue team).

This workflow is intentionally protocol-agnostic; the same loop works on a file uploader, a search endpoint, a mail composer, or a Redis-backed cache.

10. DEFENSE AWARENESS

Five layers, all needed; any single one is bypassable in isolation.

Blue-team smell tests:

• Logs contain CJK / Latin-Extended characters at positions where the protocol grammar expects ASCII (filename, header value, mail address).
• The HEX dump of a request contains bytes outside 0x20..0x7E adjacent to protocol delimiters.
• A pen-test or scanner reports a "weird 200" that the security monitoring did not flag — Ghost Bits is the most common 2025-2026 cause for that pattern in Java stacks.

11. QUICK REFERENCE — KEY PAYLOADS

REFERENCES

• Black Hat Asia 2026 — Cast Attack: A New Threat Posed by Ghost Bits in Java. Speakers: Xinyu Bai (@b1u3r / @iSafeBlue), Zhihui Chen (@1ue). Contributor: Zongzheng Zheng (@chun_springX).
• Real-world CVEs re-enabled: GeoServer CVE-2024-36401, Spring4Shell CVE-2022-22965, Openfire CVE-2023-32315, Spring CVE-2025-41242, Jakarta Mail CVE-2025-57733, JDK HttpServer CVE-2026-21933, Apache HttpClient HTTPCLIENT-1974 / HTTPCLIENT-1978.
• Patched components to upgrade past: Apache Commons BCEL >= 6.12.0, Fastjson 2.x latest, Apache HttpClient >= 4.5.10 (or migrate to 5.x), GeoServer >= 2.28.3, Openfire >= 5.0.4. Confirm vendor advisories before relying on any single version number.