CVEs-PoC/2018/CVE-2018-5968.md

CVE-2018-5968

Description

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

POC

Reference

• https://www.oracle.com/security-alerts/cpuoct2020.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Anonymous-Phunter/PHunter
• https://github.com/CGCL-codes/PHunter
• https://github.com/FHGZS/jackson-rce-via-two-new-gadgets
• https://github.com/OneSourceCat/jackson-rce-via-two-new-gadgets
• https://github.com/PalindromeLabs/Java-Deserialization-CVEs
• https://github.com/ilmari666/cybsec
• https://github.com/javaExploit/jackson-rce-via-two-new-gadgets
• https://github.com/seal-community/patches
• https://github.com/yahoo/cubed
• https://github.com/yaojieno1/jackson-rce-some-gadgets