CVE-2020-8840 PoC — FasterXML jackson-databind 代码问题漏洞

Source

https://github.com/Blyth0He/CVE-2020-8840

Associated Vulnerability

Title:FasterXML jackson-databind 代码问题漏洞 (CVE-2020-8840)
Description:FasterXML jackson-databind是FasterXML公司的一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。 FasterXML jackson-databind 2.0.0版本至2.9.10.2版本中存在代码问题漏洞，该漏洞源于程序缺少xbean-reflect/JNDI黑名单类。攻击者可利用该漏洞执行代码。

Description

jackson jndi injection

File Snapshot


 [4.0K]  /data/pocs/4de7ace66fa61fb0f316d182e4831fdd3407aaec
├── [ 397]  build.gradle
├── [4.0K]  gradle
│   └── [4.0K]  wrapper
│       ├── [ 57K]  gradle-wrapper.jar
│       └── [ 200]  gradle-wrapper.properties
├── [5.6K]  gradlew
├── [2.8K]  gradlew.bat
├── [ 408]  README.MD
├── [  36]  settings.gradle
└── [4.0K]  src
    └── [4.0K]  main
        └── [4.0K]  java
            └── [ 512]  Poc.java

5 directories, 8 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!