CVE-2017-7525 PoC — FasterXML Jackson 代码问题漏洞

Description

Insecure Java Deserialization Lab

介绍

# CVE-2017-7525 Java Insecure Deserialization Lab

Basic Java REST application vulnerable to Insecure Deserialization, leading to RCE.  

The project must be run on Java < **8u45**

Based on Maven with the following dependencies:  

- jackson-databind 2.2.2
- commons-collections 3.1
- spring-context-support 4.3.11

More dependencies can be added through Maven if you want to try some more gadgets.  

## Running

Open (recommended with Intellij Idea) and run the Java class in **src/main/java/com/deserialization/lab/Main.java**.  

Then browse to **http://localhost:9091/api/**

### Exposed APIs

- GET /api/message : returns a serialized object useful to build a payload
- POST /api/message : Accepts a payload, deserializes it and reflects the generated instance as response

### CVEs

The application is actually vulnerable to almost all the [Jackson Databind CVEs](https://www.cvedetails.com/vulnerability-list/vendor_id-15866/product_id-42991/version_id-237456/Fasterxml-Jackson-databind-2.2.2.html).

### References

[ysoserial](https://github.com/frohoff/ysoserial)  
[Exploiting the Jackson RCE: CVE-2017-7525](https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/)  
[Java Deserialization Cheat Sheet](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet)  
[Marshalsec PDF](https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true)  

### JDK Downloads

[Jdk 8 Archive](https://www.oracle.com/java/technologies/javase/javase8-archive-downloads.html)  
[Jdk 8u11 Linux x64](https://download.oracle.com/otn/java/jdk/8u11-b12/jdk-8u11-linux-x64.tar.gz)

### Authors

[alp4ca](https://twitter.com/martinolessio)  
[rhpco](https://twitter.com/rhpco)


check

文件快照

备注