irsl/jackson-rce-via-spel

irsl/jackson-rce-via-spel

GitHubGitHub
GitHubgithub.com
Releases0
Stars123
An example project that exploits the default typing issue in Jackson-databind via Spring application contexts and expressions
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2017-17485↗
9.8 CRITICAL7.5 HIGH

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.