Demo-Exploit-Jackson-RCE
Demo-Exploit-Jackson-RCE copied to clipboard
New user Payload supposed to be safe?
Hi!
I can't make the example payload (which references docs/spel.xml) - or an other payload that works via the upload API - work with the /users backend path. Looking at the code, I can't seem to find what the issue is. Does mapping the object into a JSON string and only then reading it disable the actual deserialization of the object? What am I missing?
Hey, the example payload should work. Maybe you are not using a windows machine or your java backend does have not enough permissions to run calc.exe. Maybe you can run it as administrator?
Indeed, I do not have a Windows machine (backend is served via a Linux Docker container). I can get the payload to work via the upload, but not via the user creation endpoint. It does not seem to react to the json payload (example or mine) at all. Even non-sense inputs don't return errors. I can see the requests go towards the backend endpoint, but the answers are "clean".