mirror of
https://github.com/0xMarcio/cve.git
synced 2026-05-14 23:28:04 +02:00
0xMarcio
42 lines
2.1 KiB
Markdown
42 lines
2.1 KiB
Markdown
### [CVE-2015-3253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3253)
|
|
|
|
|
|
|
|
|
|
### Description
|
|
|
|
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
|
|
|
|
### POC
|
|
|
|
#### Reference
|
|
- http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html
|
|
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
|
|
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
|
|
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
|
|
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
|
|
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
|
|
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
|
|
- http://www.securityfocus.com/bid/91787
|
|
- https://www.oracle.com/security-alerts/cpuapr2020.html
|
|
|
|
#### Github
|
|
- https://github.com/ARPSyndicate/cvemon
|
|
- https://github.com/AdeliaNitzsche/Java-Deserialization-Cheat-Sheet
|
|
- https://github.com/Anonymous-Phunter/PHunter
|
|
- https://github.com/BrittanyKuhn/javascript-tutorial
|
|
- https://github.com/CGCL-codes/PHunter
|
|
- https://github.com/CodeIntelligenceTesting/java-demo
|
|
- https://github.com/CodeIntelligenceTesting/java-demo-old
|
|
- https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
|
|
- https://github.com/LibHunter/LibHunter
|
|
- https://github.com/PalindromeLabs/Java-Deserialization-CVEs
|
|
- https://github.com/TheGrinch/elastic
|
|
- https://github.com/angelwhu/XStream_unserialization
|
|
- https://github.com/elastic/elasticsearch-groovy
|
|
- https://github.com/gitrobtest/Java-Security
|
|
- https://github.com/klausware/Java-Deserialization-Cheat-Sheet
|
|
- https://github.com/mishmashclone/GrrrDog-Java-Deserialization-Cheat-Sheet
|
|
- https://github.com/takabaya-shi/AWAE-preparation
|
|
|