Basic Java REST application vulnerable to Insecure Deserialization, leading to RCE.
The project must be run on Java < 8u45
Based on Maven with the following dependencies:
- jackson-databind 2.2.2
- commons-collections 3.1
- spring-context-support 4.3.11
More dependencies can be added through Maven if you want to try some more gadgets.
Open (recommended with Intellij Idea) and run the Java class in src/main/java/com/deserialization/lab/Main.java.
Then browse to http:https://localhost:9091/api/
- GET /api/message : returns a serialized object useful to build a payload
- POST /api/message : Accepts a payload, deserializes it and reflects the generated instance as response
The application is actually vulnerable to almost all the Jackson Databind CVEs.
ysoserial
Exploiting the Jackson RCE: CVE-2017-7525
Java Deserialization Cheat Sheet
Marshalsec PDF
Jdk 8 Archive
Jdk 8u11 Linux x64
check
