mirror of
https://github.com/0xMarcio/cve.git
synced 2026-05-14 06:52:09 +02:00
0xMarcio
42 lines
2.1 KiB
Markdown
42 lines
2.1 KiB
Markdown
### [CVE-2018-7489](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489)
|
|
|
|
|
|
|
|
|
|
### Description
|
|
|
|
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
|
|
|
|
### POC
|
|
|
|
#### Reference
|
|
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
|
|
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
|
|
- https://www.oracle.com/security-alerts/cpuoct2020.html
|
|
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
|
|
|
|
#### Github
|
|
- https://github.com/0xT11/CVE-POC
|
|
- https://github.com/ARPSyndicate/cvemon
|
|
- https://github.com/OWASP/www-project-ide-vulscanner
|
|
- https://github.com/PalindromeLabs/Java-Deserialization-CVEs
|
|
- https://github.com/bkhablenko/CVE-2017-8046
|
|
- https://github.com/cf-testorg/aws-sdk-java-test
|
|
- https://github.com/dashpradeep99/aws-sdk-java-code
|
|
- https://github.com/dashpradeep99/https-github.com-aws-aws-sdk-java
|
|
- https://github.com/dotanuki-labs/android-oss-cves-research
|
|
- https://github.com/hectorgie/PoC-in-GitHub
|
|
- https://github.com/ilmari666/cybsec
|
|
- https://github.com/klarna/kco_rest_java
|
|
- https://github.com/maddoudou22/repo-aws-sdk-java
|
|
- https://github.com/maddoudou22/test-aws-sdk-java
|
|
- https://github.com/maddoudou22/test-aws-sdk-java-B
|
|
- https://github.com/pawankeshri/aws-sdk-java-master
|
|
- https://github.com/sdstoehr/har-reader
|
|
- https://github.com/seal-community/patches
|
|
- https://github.com/speedycloud/java-sdk
|
|
- https://github.com/tafamace/CVE-2018-7489
|
|
- https://github.com/yahoo/cubed
|
|
- https://github.com/zema1/oracle-vuln-crawler
|
|
|