Insecure Java Deserialization Lab# CVE-2017-7525 Java Insecure Deserialization Lab
Basic Java REST application vulnerable to Insecure Deserialization, leading to RCE.
The project must be run on Java < **8u45**
Based on Maven with the following dependencies:
- jackson-databind 2.2.2
- commons-collections 3.1
- spring-context-support 4.3.11
More dependencies can be added through Maven if you want to try some more gadgets.
## Running
Open (recommended with Intellij Idea) and run the Java class in **src/main/java/com/deserialization/lab/Main.java**.
Then browse to **http://localhost:9091/api/**
### Exposed APIs
- GET /api/message : returns a serialized object useful to build a payload
- POST /api/message : Accepts a payload, deserializes it and reflects the generated instance as response
### CVEs
The application is actually vulnerable to almost all the [Jackson Databind CVEs](https://www.cvedetails.com/vulnerability-list/vendor_id-15866/product_id-42991/version_id-237456/Fasterxml-Jackson-databind-2.2.2.html).
### References
[ysoserial](https://github.com/frohoff/ysoserial)
[Exploiting the Jackson RCE: CVE-2017-7525](https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/)
[Java Deserialization Cheat Sheet](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet)
[Marshalsec PDF](https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true)
### JDK Downloads
[Jdk 8 Archive](https://www.oracle.com/java/technologies/javase/javase8-archive-downloads.html)
[Jdk 8u11 Linux x64](https://download.oracle.com/otn/java/jdk/8u11-b12/jdk-8u11-linux-x64.tar.gz)
### Authors
[alp4ca](https://twitter.com/martinolessio)
[rhpco](https://twitter.com/rhpco)
check
[4.0K] /data/pocs/d2f8529b8f60b020575898290804e861fded764c
├── [3.5K] pom.xml
├── [1.7K] README.md
├── [5.3K] Solution.md
├── [4.0K] src
│ └── [4.0K] main
│ ├── [4.0K] java
│ │ └── [4.0K] com
│ │ └── [4.0K] deserialization
│ │ └── [4.0K] lab
│ │ ├── [1005] Main.java
│ │ ├── [4.0K] model
│ │ │ ├── [ 604] APIMessage.java
│ │ │ └── [ 489] Payload.java
│ │ ├── [4.0K] processor
│ │ │ ├── [ 867] DefaultPostProcessor.java
│ │ │ ├── [ 984] PayloadGetBytesProcessor.java
│ │ │ └── [ 975] PayloadGetProcessor.java
│ │ ├── [4.0K] route
│ │ │ └── [1.4K] RouteBuilderImpl.java
│ │ └── [1.4K] Test.java
│ └── [4.0K] resources
│ └── [ 571] log4j2.xml
└── [4.0K] static
└── [ 374] exploit.xml
11 directories, 13 files