Orange Tsai

Background

Orange Tsai is a Taiwan-based web application security researcher who serves as principal security researcher at DEVCORE, a Taipei-based information security consultancy, and is a core member of the CHROOT security group. He has described his first publicly credited vulnerability as CVE-2012-4775 (MS12-071), a use-after-free bug in Internet Explorer found through fuzzing.

Vulnerability Research and the Exchange Server Disclosures

Tsai built his reputation on finding remote-code-execution and server-side request forgery bugs in widely used enterprise and consumer-facing software, reporting flaws affecting products and services from Facebook, Twitter, Uber, Apple, GitHub, and other major vendors. His best-known work concerns Microsoft Exchange Server: DEVCORE reported an Exchange vulnerability to Microsoft on 5 January 2021, which Microsoft confirmed on 8 January; the underlying flaws were later chained into exploits that became widely known as ProxyLogon after being exploited in mass intrusions in early 2021. Tsai and DEVCORE colleagues also devised a related exploit chain nicknamed 'ProxyShell,' which he demonstrated at Pwn2Own Vancouver in April 2021. Both chains were detailed publicly in his August 2021 Black Hat USA and DEF CON 29 talk, 'ProxyLogon is Just the Tip of the Iceberg.'

Other Research and Conference Talks

Before the Exchange work, Tsai was known for research into URL-parser inconsistencies used for server-side request forgery, presented as 'A New Era of SSRF' at Black Hat USA and DEF CON 25 in 2017, and for path-normalization/parser-logic bugs usable to bypass web application firewalls, presented at Black Hat USA and DEF CON 26 in 2018. In 2019 he presented pre-authentication RCE research against corporate SSL VPN products at Black Hat USA and DEF CON 27.

Awards and Pwn2Own Record

Tsai's research has repeatedly been recognized with Pwnie Awards for 'Best Server-Side Bug' (2019, for SSL VPN pre-auth RCEs, and 2021, for the Exchange Server RCEs). At the Pwn2Own competition, he and the DEVCORE Research Team were named 'Master of Pwn' at Vancouver in 2021 and Toronto in 2022.

Legacy

Tsai is frequently cited as one of the researchers who put Taiwanese and broader Asia-based offensive security research on the international stage, and DEVCORE's Exchange Server disclosures are commonly referenced in accounts of the 2021 ProxyLogon/ProxyShell incidents.

Timeline

• 2012Credited with his first published CVE, CVE-2012-4775 (MS12-071), a use-after-free vulnerability in Internet Explorer found through fuzzing.
• 2017-07-27Presented 'A New Era of SSRF' at Black Hat USA 2017 (repeated at DEF CON 25).
• 2018-08-08Presented 'Breaking Parser Logic' at Black Hat USA 2018 (repeated at DEF CON 26).
• 2019-08-07Presented pre-auth RCE research on leading SSL VPNs at Black Hat USA 2019; the research won a 2019 Pwnie Award for Best Server-Side Bug.
• 2021-01-05DEVCORE reported an Exchange Server vulnerability to Microsoft; the flaw chain was later exploited at scale and became known as ProxyLogon.
• 2021-04Demonstrated the 'ProxyShell' Exchange Server pre-authentication RCE chain at Pwn2Own Vancouver.
• 2021-08-05Presented 'ProxyLogon is Just the Tip of the Iceberg' at Black Hat USA 2021; the research won a 2021 Pwnie Award for Best Server-Side Bug.
• 2022Named Pwn2Own 'Master of Pwn' at Pwn2Own Toronto.