Basic Java REST application vulnerable to Insecure Deserialization, leading to RCE.
The project must be run on Java < 8u45
Based on Maven with the following dependencies:
- jackson-databind 2.2.2
- commons-collections 3.1
- spring-context-support 4.3.11
More dependencies can be added through Maven if you want to try some more gadgets.
docker build -t cve-2017-7525 .
docker run -p 9091:9091 cve-2017-7525
Then browse to https://localhost:9091/api/
- GET /api/message : returns a serialized object useful to build a payload
- POST /api/message : Accepts a payload, deserializes it and reflects the generated instance as response
The application is actually vulnerable to almost all the Jackson Databind CVEs.
ysoserial
Exploiting the Jackson RCE: CVE-2017-7525
Java Deserialization Cheat Sheet
Marshalsec PDF
Jdk 8 Archive
Jdk 8u11 Linux x64
check