CVE-2019-12384

This repository contains a functional exploit for CVE-2019-12384, demonstrating a Jackson deserialization vulnerability leading to RCE via H2 database JDBC URL injection. The PoC uses JRuby to trigger the exploit chain, fetching and executing a malicious SQL script from a remote server.

This repository contains a functional exploit for CVE-2019-12384, leveraging Jackson deserialization to execute arbitrary commands via H2 database alias functionality. The PoC demonstrates RCE by triggering a calculator popup through a crafted payload.

This repository contains a vulnerable version of Jackson Databind (2.9.0) that demonstrates CVE-2019-12384, a deserialization vulnerability. The included source code and build configuration allow for testing and exploitation of the flaw.