CVE-2020-1948

This repository contains a proof-of-concept exploit for CVE-2020-1948, targeting Apache Dubbo's Hessian deserialization vulnerability. It includes tools for generating JNDI injection payloads and a Python script to send malicious Hessian payloads to vulnerable endpoints.

This repository appears to be a legitimate Apache Dubbo Spring Boot project with no exploit code. It contains configuration files, autoconfigure modules, and actuator endpoints, but no proof-of-concept exploit for CVE-2020-1948.

This repository provides a functional test environment for CVE-2020-1948, a deserialization vulnerability in Apache Dubbo. It includes a modified Dubbo Spring Boot sample to demonstrate the vulnerability, with instructions for compilation, execution, and containerization.

This PoC exploits CVE-2020-1948, a deserialization vulnerability in Apache Dubbo, by sending a malicious payload to trigger an LDAP connection. It uses the Hessian2 decoder to craft a malicious object chain involving JdbcRowSetImpl and ToStringBean.