CVE-2017-17485
CRITICALjackson-databind < 2.6.7.3, 2.9.0-2.9.3 - Unauthenticated Remote Code Execution via Malicious JSON Input
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2017-17485. PoCs published by Al1ex, dawetmaster, andikahilmy.
AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2017-17485, a deserialization vulnerability in Jackson-databind. The PoC demonstrates remote code execution by leveraging LDAP-based object injection via malicious JSON input.
Description
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
Exploits (5)
This repository contains a proof-of-concept exploit for CVE-2017-17485, a deserialization vulnerability in Jackson-databind. The PoC demonstrates remote code execution by leveraging LDAP-based object injection via malicious JSON input.
This repository contains a vulnerable version of Jackson Databind (2.9.0) that is susceptible to CVE-2017-17485, a deserialization vulnerability. The included source code and build configuration allow for testing and exploitation of the flaw.
This repository contains a vulnerable version of Jackson Databind (2.9.0) that is susceptible to CVE-2017-17485, a deserialization vulnerability. The included codebase allows for testing and exploitation of the vulnerability, which can lead to remote code execution (RCE) under certain conditions.
The provided code is a simple Java stub that prints command-line arguments and does not demonstrate any exploit functionality for CVE-2017-17485. It lacks offensive techniques or vulnerability-specific logic.
References (24)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H