CVE-2017-7525 PoC — FasterXML Jackson 代码问题漏洞

Source

Associated Vulnerability

Title:FasterXML Jackson 代码问题漏洞 (CVE-2017-7525)
Description:A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Description

Demo for CVE-2017-7525

Readme

# Demo-Exploit-Jackson-RCE
This project serves as an example web application to test attack on the Jackson-databind vulnerability [CVE-2017-17485](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17485).  

## Build
Build and package spring boot and angular7 into a deployable war file.
> `mvn package`

## Run
Which automatically opens a web browser at `http://localhost:4200`. 
> `backend/mvn spring-boot:run`                                  

## Demo 
![Demo gif](./jackson-rce-demo.gif)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!