CVE-2020-10673 PoC — FasterXML jackson-databind 安全漏洞

Source

https://github.com/harry1080/CVE-2020-10673

Associated Vulnerability

Title: FasterXML jackson-databind 安全漏洞 (CVE-2020-10673)
Description:FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

Description

CVE-2020-10673

Readme

### 漏洞描述

近日,亚信安全网络攻防实验室跟踪到 `jackson-databind` 更新了1个jndi注入的黑名单类.如果在项目包中存在该类的jar包且JDK版本满足注入版本,则可以使用JNDI注入的方式导致远程代码执行.该类为 `com.caucho.config.types.ResourceRef`.

漏洞编号：

- CVE-2020-10673
- Jackson内部编号2660

## 影响范围

- jackson-databind <= 2.10.3

- fastjson <= 1.2.66

##  修复建议

目前官方已发表修复补丁，可进入

<https://github.com/alibaba/fastjson/releases>

页面下载最新版本。

## 参考

- [【安全通报】Fastjson发布高危漏洞补丁](https://nosec.org/home/detail/4368.html)
- [【漏洞通告】CVE-2020-10673/jackson-databind JNDI注入导致远程代码执行](https://mp.weixin.qq.com/s/nKTd9I_EUzEqHOrpCqGVbQ)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →