CVE-2017-17485

Jackson 反序列化 漏洞描述 CVE-2017-7525 CVE-2017-7525详情 githubcom/iBearcat/S2-055 官方在漏洞产生后，通过黑名单的方式禁止黑名单中的第三方库反序列化问题而产生的代码执行漏洞,黑名单是一种不可靠的修复方式，攻击者常常可以通过一些手段绕过黑名单，造成新漏洞产生，可以说是S2-055

CVE-2017-17485:Jackson-databind RCE

CVE-2017-17485 CVE-2017-17485:Jackson-databind RCE

Package $ sbt stage $ file /target/helloshiftleft-play-jpa-scala-001-SNAPSHOTjar Run $ sbt run Http routes See routes at config/routes Use localhost as host name in the URLs To interact with the endpoints use curl (or any other tool) GET /account GET /createCustomer POST /account curl localhos

An example project that exploits the default typing issue in Jackson-databind via Spring application contexts and expressions

jackson-rce-via-spel An example project that exploits the default typing issue in Jackson-databind (githubcom/FasterXML/jackson-databind) via Spring application contexts and expressions Context The Jackson-databind project has a feature called default-typing (not enabled by default) When the target class has some polymorph fields inside (such as interfaces, abstract c

vulnerable play app

Package $ sbt stage $ file /target/helloshiftleftplay-000-SNAPSHOTjar Run $ sbt run Http routes See routes at config/routes Use localhost as host name in the URLs To interact with the endpoints use curl (or any other tool) GET /account GET /createCustomer POST /account curl localhost:8082

jackson-databind-POC 存在漏洞示例/误报示例 先看几个白盒检测存在漏洞的示例： 来源：githubcom/find-sec-bugs/find-sec-bugs/blob/master/findsecbugs-samples-java/src/test/java/testcode/serial/UnsafeJacksonObjectDeserializationjava public class UnsafeJacksonObjectDeserialization { static class ABean { public int id; public O

Demo for CVE-2017-7525

Demo-Exploit-Jackson-RCE This project serves as an example web application to test attack on the Jackson-databind vulnerability CVE-2017-17485 Build Build and package spring boot and angular7 into a deployable war file mvn package Run Which automatically opens a web browser at localhost:4200 backend/mvn spring-boot:run Demo

spel.xml

jackson-rce-via-spel An example project that exploits the default typing issue in Jackson-databind (githubcom/FasterXML/jackson-databind) via Spring application contexts and expressions Context The Jackson-databind project has a feature called default-typing (not enabled by default) When the target class has some polymorph fields inside (such as interfaces, abstract c

Package $ sbt stage $ file /target/helloshiftleft-play-jpa-scala-001-SNAPSHOTjar Run $ sbt run Http routes See routes at config/routes Use localhost as host name in the URLs To interact with the endpoints use curl (or any other tool) GET /account GET /createCustomer POST /account curl localhos