## https://sploitus.com/exploit?id=60C4C506-F123-56B4-91EF-EA1366A38CDF
# CVE-2017-7525 Java Insecure Deserialization Lab
Basic Java REST application vulnerable to Insecure Deserialization, leading to RCE.
The project must be run on Java < **8u45**
Based on Maven with the following dependencies:
- jackson-databind 2.2.2
- commons-collections 3.1
- spring-context-support 4.3.11
More dependencies can be added through Maven if you want to try some more gadgets.
## Running
Open (recommended with Intellij Idea) and run the Java class in **src/main/java/com/deserialization/lab/Main.java**.
Then browse to **http://localhost:9091/api/**
### Exposed APIs
- GET /api/message : returns a serialized object useful to build a payload
- POST /api/message : Accepts a payload, deserializes it and reflects the generated instance as response
### CVEs
The application is actually vulnerable to almost all the [Jackson Databind CVEs](https://www.cvedetails.com/vulnerability-list/vendor_id-15866/product_id-42991/version_id-237456/Fasterxml-Jackson-databind-2.2.2.html).
### References
[ysoserial](https://github.com/frohoff/ysoserial)
[Exploiting the Jackson RCE: CVE-2017-7525](https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/)
[Java Deserialization Cheat Sheet](https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet)
[Marshalsec PDF](https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true)
### JDK Downloads
[Jdk 8 Archive](https://www.oracle.com/java/technologies/javase/javase8-archive-downloads.html)
[Jdk 8u11 Linux x64](https://download.oracle.com/otn/java/jdk/8u11-b12/jdk-8u11-linux-x64.tar.gz)
### Authors
[alp4ca](https://twitter.com/martinolessio)
[rhpco](https://twitter.com/rhpco)
check