CVE-2020-36184

This repository contains a functional exploit for CVE-2020-36184, demonstrating RCE via deserialization in FasterXML jackson-databind. The PoC leverages the PerUserPoolDataSource gadget chain to trigger an LDAP lookup, executing arbitrary code (e.g., 'calc') when deserializing malicious JSON input.

This repository contains a vulnerable version of Jackson Databind (2.9.0) that demonstrates CVE-2020-36184, a deserialization vulnerability. The included source code and build configuration allow for testing and exploitation of the flaw.

This repository contains a vulnerable version of Jackson Databind (2.9.0) that is susceptible to CVE-2020-36184, a deserialization vulnerability. The included source code and build configuration allow for testing and exploitation of the flaw.