Demo-Exploit-Jackson-RCE icon indicating copy to clipboard operation
Demo-Exploit-Jackson-RCE copied to clipboard

New user Payload supposed to be safe?

Open bt-nia opened this issue 3 years ago • 2 comments

Hi!

I can't make the example payload (which references docs/spel.xml) - or an other payload that works via the upload API - work with the /users backend path. Looking at the code, I can't seem to find what the issue is. Does mapping the object into a JSON string and only then reading it disable the actual deserialization of the object? What am I missing?

bt-nia avatar May 14 '21 13:05 bt-nia

Hey, the example payload should work. Maybe you are not using a windows machine or your java backend does have not enough permissions to run calc.exe. Maybe you can run it as administrator?

JavanXD avatar May 17 '21 14:05 JavanXD

Indeed, I do not have a Windows machine (backend is served via a Linux Docker container). I can get the payload to work via the upload, but not via the user creation endpoint. It does not seem to react to the json payload (example or mine) at all. Even non-sense inputs don't return errors. I can see the requests go towards the backend endpoint, but the answers are "clean".

bt-nia avatar May 17 '21 14:05 bt-nia