CVE-2017-7525

This repository is a detailed writeup and analysis of CVE-2017-7525 and CVE-2017-15095, focusing on the deserialization vulnerabilities in Jackson-databind and their impact on Apache Struts2. It includes explanatory code snippets and references to related CVEs and fixes.

This repository demonstrates a working exploit for CVE-2017-7525, a Jackson-databind deserialization vulnerability. It includes a Spring Boot backend and Angular frontend to test attack vectors like file uploads and form submissions.

This repository contains a Java-based lab demonstrating CVE-2017-7525, a Jackson deserialization vulnerability leading to RCE. It includes a vulnerable REST API and payload generation utilities.

This PoC demonstrates a deserialization vulnerability in Jackson (CVE-2017-7525) by enabling default typing and reading a malicious payload from a file. The exploit leverages unsafe deserialization to achieve arbitrary code execution.

This repository contains a functional exploit for CVE-2017-7525, a deserialization vulnerability in Jackson Databind. It leverages the TemplatesImpl gadget to execute arbitrary code via crafted JSON input, with a provided test file to automate payload generation and execution.

This is a working proof-of-concept exploit for CVE-2017-7525, a deserialization vulnerability in Apache Struts2 REST plugin. The exploit uses a malicious serialized object to execute arbitrary commands (e.g., 'calc') via the Xalan XSLT library.