Java-Deserialization-Cheat-Sheet
A cheat sheet for pentesters and researchers about deserialization vulnerabilities in various Java (JVM) serialization libraries.
Please, use #javadeser hash tag for tweets.
Table of content
Java Native Serialization (binary)
Overview
Main talks & presentations & docs
Marshalling Pickles
by @frohoff & @gebl
Exploiting Deserialization Vulnerabilities in Java
by @matthias_kaiser
Serial Killer: Silently Pwning Your Java Endpoints
by @pwntester & @cschneider4711
Deserialize My Shorts: Or How I Learned To Start Worrying and Hate Java Object Deserialization
by @frohoff & @gebl
Surviving the Java serialization apocalypse
by @cschneider4711 & @pwntester
Java Deserialization Vulnerabilities - The Forgotten Bug Class
by @matthias_kaiser
Pwning Your Java Messaging With Deserialization Vulnerabilities
by @matthias_kaiser
Defending against Java Deserialization Vulnerabilities
by @lucacarettoni
A Journey From JNDI/LDAP Manipulation To Remote Code Execution Dream Land
by @pwntester and O. Mirosh
Fixing the Java Serialization mess
by @e_rnst
Blind Java Deserialization
by deadcode.me
An Overview of Deserialization Vulnerabilities in the Java Virtual Machine (JVM)
by @joaomatosf
Automated Discovery of Deserialization Gadget Chains
by @ianhaken
An Far Sides Of Java Remote Protocols
by @_tint0
Payload generators
ysoserial
https://github.com/frohoff/ysoserial
ysoserial 0.6 payloads:
| payload |
author |
dependencies |
impact (if not RCE) |
| AspectJWeaver |
@Jang |
aspectjweaver:1.9.2, commons-collections:3.2.2 |
|
| BeanShell1 |
@pwntester, @cschneider4711 |
bsh:2.0b5 |
|
| C3P0 |
@mbechler |
c3p0:0.9.5.2, mchange-commons-java:0.2.11 |
|
| Click1 |
@artsploit |
click-nodeps:2.3.0, javax.servlet-api:3.1.0 |
|
| Clojure |
@JackOfMostTrades |
clojure:1.8.0 |
|
| CommonsBeanutils1 |
@frohoff |
commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2 |
|
| CommonsCollections1 |
@frohoff |
commons-collections:3.1 |
|
| CommonsCollections2 |
@frohoff |
commons-collections4:4.0 |
|
| CommonsCollections3 |
@frohoff |
commons-collections:3.1 |
|
| CommonsCollections4 |
@frohoff |
commons-collections4:4.0 |
|
| CommonsCollections5 |
@matthias_kaiser, @jasinner |
commons-collections:3.1 |
|
| CommonsCollections6 |
@matthias_kaiser |
commons-collections:3.1 |
|
| CommonsCollections7 |
@scristalli, @hanyrax, @EdoardoVignati |
commons-collections:3.1 |
|
| FileUpload1 |
@mbechler |
commons-fileupload:1.3.1, commons-io:2.4 |
file uploading |
| Groovy1 |
@frohoff |
groovy:2.3.9 |
|
| Hibernate1 |
@mbechler |
|
|
| Hibernate2 |
@mbechler |
|
|
| JBossInterceptors1 |
@matthias_kaiser |
javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21 |
|
| JRMPClient |
@mbechler |
|
|
| JRMPListener |
@mbechler |
|
|
| JSON1 |
@mbechler |
json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1 |
|
| JavassistWeld1 |
@matthias_kaiser |
javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21 |
|
| Jdk7u21 |
@frohoff |
|
|
| Jython1 |
@pwntester, @cschneider4711 |
jython-standalone:2.5.2 |
|
| MozillaRhino1 |
@matthias_kaiser |
js:1.7R2 |
|
| MozillaRhino2 |
@_tint0 |
js:1.7R2 |
|
| Myfaces1 |
@mbechler |
|
|
| Myfaces2 |
@mbechler |
|
|
| ROME |
@mbechler |
rome:1.0 |
|
| Spring1 |
@frohoff |
spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE |
|
| Spring2 |
@mbechler |
spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2 |
|
| URLDNS |
@gebl |
|
jre only vuln detect |
| Vaadin1 |
@kai_ullrich |
vaadin-server:7.7.14, vaadin-shared:7.7.14 |
|
| Wicket1 |
@jacob-baines |
wicket-util:6.23.0, slf4j-api:1.6.4 |
|
Plugins for Burp Suite (detection, ysoserial integration ):
Full shell (pipes, redirects and other stuff):
How it works:
ysoserial fork with additional payloads
https://github.com/wh1t3p1g/ysoserial
- CommonsCollection8,9,10
- RMIRegistryExploit2,3
- RMIRefListener,RMIRefListener2
- PayloadHTTPServer
- Spring3
JRE8u20_RCE_Gadget
https://github.com/pwntester/JRE8u20_RCE_Gadget
Pure JRE 8 RCE Deserialization gadget
ACEDcup
https://github.com/GrrrDog/ACEDcup
File uploading via:
- Apache Commons FileUpload <= 1.3 (CVE-2013-2186) and Oracle JDK < 7u40
Universal billion-laughs DoS
https://gist.github.com/coekie/a27cc406fc9f3dc7a70d
Won't fix DoS via default Java classes (JRE)
Universal Heap overflows DoS using Arrays and HashMaps
https://github.com/topolik/ois-dos/
How it works:
Won't fix DoS using default Java classes (JRE)
DoS against Serialization Filtering (JEP-290)
Tool to search gadgets in source
Additional tools to test RMI:
Remote class detection:
Exploits
no spec tool - You don't need a special tool (just Burp/ZAP + payload)
RMI
ysoserial
Additional tools
JMX
ysoserial
mjet
JexBoss
JMXMP
JNDI/LDAP
https://github.com/zerothoughts/jndipoc
https://github.com/welk1n/JNDI-Injection-Exploit
JMS
JMET
JSF ViewState
- if no encryption or good mac
no spec tool
JexBoss
vjdbc
- JDBC via HTTP library
- all version are vulnerable
- Details
no spec tool
T3 of Oracle Weblogic
loubia (tested on 11g and 12c, supports t3s)
JavaUnserializeExploits (doesn't work for all Weblogic versions)
WLT3Serial
CVE-2018-2628 sploit
IIOP of Oracle Weblogic
CVE-2020-2551 sploit
Oracle Weblogic (1)
Oracle Weblogic (2)
Exploit
IBM Websphere (1)
JavaUnserializeExploits
serialator
CoalfireLabs/java_deserialization_exploits
IBM Websphere (2)
- When using custom form authentication
- WASPostParam cookie
- Full info
no spec tool
IBM Websphere (3)
Metasploit
IIOP of IBM Websphere
Red Hat JBoss (1)
- http://jboss_server/invoker/JMXInvokerServlet
- Default port - 8080/tcp
- CVE-2015-7501
JavaUnserializeExploits
https://github.com/njfox/Java-Deserialization-Exploit
serialator
JexBoss
Red Hat JBoss 6.X
- http://jboss_server/invoker/readonly
- Default port - 8080/tcp
- CVE-2017-12149
- JBoss 6.X and EAP 5.X
- Details
no spec tool
Red Hat JBoss 4.x
- http://jboss_server/jbossmq-httpil/HTTPServerILServlet/
- <= 4.x
- CVE-2017-7504
no spec tool
Jenkins (1)
JavaUnserializeExploits
JexBoss
Jenkins (2)
ysoserial
Jenkins (s)
- Jenkins CLI LDAP
- *Default port - High number/tcp
- <= 2.32
- <= 2.19.3 (LTS)
- CVE-2016-9299
CloudBees Jenkins
Sploit
JetBrains TeamCity
ysoserial
Restlet
- <= 2.1.2
- When Rest API accepts serialized objects (uses ObjectRepresentation)
no spec tool
RESTEasy
- *When Rest API accepts serialized objects (uses @Consumes({"*/*"}) or "application/*" )
- Details and examples
no spec tool
OpenNMS (1)
ysoserial
OpenNMS (2)
JMET
Progress OpenEdge RDBMS
ysoserial
Commvault Edge Server
no spec tool
Symantec Endpoint Protection Manager
serialator
Oracle MySQL Enterprise Monitor
no spec tool
serialator
PowerFolder Business Enterprise Suite
powerfolder-exploit-poc
Solarwinds Virtualization Manager
ysoserial
Cisco Prime Infrastructure
- https://[target]/xmp_data_handler_service/xmpDataOperationRequestServlet
- <= 2.2.3 Update 4
- <= 3.0.2
- CVE-2016-1291
CoalfireLabs/java_deserialization_exploits
Cisco ACS
ysoserial
Cisco Unity Express
ysoserial
Cisco Unified CVP
ysoserial
NASDAQ BWISE
ysoserial
NICE ENGAGE PLATFORM
Apache Cassandra
Cloudera Zookeeper
Apache Olingo
no spec tool
Apache Dubbo
no spec tool
Apache XML-RPC
no spec tool
Apache Archiva
no spec tool
SAP NetWeaver
- https://[target]/developmentserver/metadatauploader
- CVE-2017-9844
PoC
SAP Hybris
no spec tool
Sun Java Web Console
no spec tool
Apache MyFaces Trinidad
- 1.0.0 <= version < 1.0.13
- 1.2.1 <= version < 1.2.14
- 2.0.0 <= version < 2.0.1
- 2.1.0 <= version < 2.1.1
- it does not check MAC
- CVE-2016-5019
no spec tool
JBoss Richfaces
Apache Tomcat JMX
JexBoss
OpenText Documentum D2
exploit
Liferay
- /api/spring
- /api/liferay
- <= 7.0-ga3
- if IP check works incorrectly
- Details
no spec tool
ScrumWorks Pro
PoC
ManageEngine Applications Manager
ysoserial
ManageEngine Desktop Central
MSF exploit
Apache Shiro
HP IMC (Intelligent Management Center)
Metasploit module
HP IMC (Intelligent Management Center)
ysoserial
Apache Brooklyn
Elassandra
Micro Focus
- CVE-2020-11853
- Vulnerability analyzis
Affected products:
- Operations Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions
- Application Performance Management versions: 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 \
- Data Center Automation version 2019.11
- Operations Bridge (containerized) versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11
- Universal CMDB versions: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30
- Hybrid Cloud Management version 2020.05
- Service Management Automation versions 2020.5 and 2020.02
Metasploit Exploit
IBM Qradar (1)
IBM Qradar (2)
Exploit
IBM InfoSphere JReport
Apache Kafka
Zoho ManageEngine ADSelfService Plus
Apache ActiveMQ - Client lib
JMET
Redhat/Apache HornetQ - Client lib
JMET
Oracle OpenMQ - Client lib
JMET
IBM WebSphereMQ - Client lib
JMET
Oracle Weblogic - Client lib
JMET
Pivotal RabbitMQ - Client lib
JMET
IBM MessageSight - Client lib
JMET
IIT Software SwiftMQ - Client lib
JMET
Apache ActiveMQ Artemis - Client lib
JMET
Apache QPID JMS - Client lib
JMET
Apache QPID - Client lib
JMET
Amazon SQS Java Messaging - Client lib
JMET
Axis/Axis2 SOAPMonitor
java -jar ysoserial-*-all.jar CommonsCollections1 'COMMAND_HERE' | nc TARGET_SERVER 5001
ysoserial
Apache Synapse
ysoserial
Apache Jmeter
- <= 3.0.1
- RMI
- When using Distributed Test only
- Exploit
ysoserial
Jolokia
- <= 1.4.0
- JNDI injection
- /jolokia/
- Exploit
RichFaces
Apache James
ysoserial
Oracle DB
Zimbra Collaboration
Adobe ColdFusion (1)
Adobe ColdFusion (2)
Adobe ColdFusion (3) / JNBridge
Apache SOLR (1)
- SOLR-8262
- 5.1 <= version <=5.4
- /stream handler uses Java serialization for RPC
Apache SOLR (2)
Adobe Experience Manager AEM
MySQL Connector/J
Pitney Bowes Spectrum
SmartBear ReadyAPI
NEC ESMPRO Manager
Apache OFBiz
NetMotion Mobility
ysoserial
Metasploit Exploit: exploit/windows/http/netmotion_mobility_mvcutil_deserialization
Detect
Code review
Traffic
- Magic bytes 'ac ed 00 05' bytes
- 'rO0' for Base64
- 'application/x-java-serialized-object' for Content-Type header
Network
- Nmap >=7.10 has more java-related probes
- use nmap --all-version to find JMX/RMI on non-standart ports
Burp plugins
Vulnerable apps (without public sploits/need more info)
Spring Service Invokers (HTTP, JMS, RMI...)
SAP P4
Apache ActiveMQ (2)
Atlassian Bamboo (1)
Atlassian Bamboo (2)
- CVE-2015-8360
- 2.3.1 <= version < 5.9.9
- Bamboo JMS port (port 54663 by default)
Atlassian Jira
- only Jira with a Data Center license
- RMI (port 40001 by default)
- JRA-46203
Akka
Spring AMPQ
Apache Tika
Apache HBase
Apache Camel
Apache Dubbo
Apache Spark
Apache Spark
Apache Log4j (1)
Apache Log4j (2)
Apache Geode
Apache Ignite
Infinispan
Hazelcast
Gradle (gui)
- custom(?) protocol(60024/tcp)
- article
Oracle Hyperion
Oracle Application Testing Suite
Red Hat JBoss BPM Suite
Red Hat Wildfly
VMWare vRealize Operations
VMWare vCenter/vRealize (various)
Cisco (various)
Cisco Security Manager
Lexmark Markvision Enterprise
McAfee ePolicy Orchestrator
HP IMC PLAT
HP iMC
HP Operations Orchestration
HP Asset Manager
HP Service Manager
HP Operations Manager
HP Release Control
HP Continuous Delivery Automation
HP P9000, XP7 Command View Advanced Edition (CVAE) Suite
HP Network Automation
Adobe Experience Manager
Unify OpenScape (various)
Apache OFBiz (1)
Apache OFBiz (2)
Apache Tomcat (1)
Apache Tomcat (2)
Apache TomEE
IBM Congnos BI
IBM Maximo Asset Management
Novell NetIQ Sentinel
ForgeRock OpenAM
- 9-9.5.5, 10.0.0-10.0.2, 10.1.0-Xpress, 11.0.0-11.0.3 and 12.0.0
- 201505-01
F5 (various)
Hitachi (various)
NetApp (various)
Citrix XenMobile Server
IBM WebSphere (1)
- SOAP connector
- <= 9.0.0.9
- <= 8.5.5.14
- <= 8.0.0.15
- <= 7.0.0.45
- CVE-2018-1567
IBM WebSphere (2)
IBM WebSphere (3)
IBM WebSphere (4)
IBM WebSphere (5)
IBM WebSphere (6)
IBM WebSphere (7)
Code42 CrashPlan
Apache OpenJPA
Dell EMC VNX Monitoring and Reporting
Taoensso Nippy
CAS
Apache Batchee
Apache JCS
Apache OpenWebBeans
Protection
For Android
Main talks & presentations & examples
Tools
XMLEncoder (XML)
How it works:
Detect
Code review
- java.beans.XMLDecoder
- readObject
Burp plugins
Exploits
Oracle Weblogic
Exploit
Oracle RDBMS
XStream (XML/JSON/various)
How it works:
Payload generators
Exploits
Apache Struts (S2-052)
Exploit
Detect
Code review
- com.thoughtworks.xstream.XStream
- xs.fromXML(data)
Burp plugins
Vulnerable apps (without public sploits/need more info):
Atlassian Bamboo
Jenkins
Kryo (binary)
How it works:
Payload generators
Detect
Code review
- com.esotericsoftware.kryo.io.Input
- SomeClass object = (SomeClass)kryo.readClassAndObject(input);
- SomeClass someObject = kryo.readObjectOrNull(input, SomeClass.class);
- SomeClass someObject = kryo.readObject(input, SomeClass.class);
Burp plugins
Hessian/Burlap (binary/XML)
How it works:
Payload generators
Detect
Code review
- com.caucho.hessian.io
- AbstractHessianInput
- com.caucho.burlap.io.BurlapInput;
- com.caucho.burlap.io.BurlapOutput;
- BurlapInput in = new BurlapInput(is);
- Person2 p1 = (Person2) in.readObject();
Burp plugins
Vulnerable apps (without public sploits/need more info):
Apache Camel
MobileIron MDM
Castor (XML)
How it works:
Payload generators
Detect
Code review
- org.codehaus.castor
- org.exolab.castor.xml.Unmarshaller
- org.springframework.oxm.Unmarshaller
- Unmarshaller.unmarshal(Person.class, reader)
- unmarshaller = context.createUnmarshaller();
- unmarshaller.unmarshal(new StringReader(data));
Burp plugins
Vulnerable apps (without public sploits/need more info):
OpenNMS
Apache Camel
json-io (JSON)
How it works:
Exploitation examples:
Payload generators
Detect
Code review
- com.cedarsoftware.util.io.JsonReader
- JsonReader.jsonToJava
Burp plugins
Jackson (JSON)
vulnerable in specific configuration
How it works:
Payload generators / gadget chains
Detect
Code review
- com.fasterxml.jackson.databind.ObjectMapper
- ObjectMapper mapper = new ObjectMapper();
- objectMapper.enableDefaultTyping();
- @JsonTypeInfo(use=JsonTypeInfo.Id.CLASS, include=JsonTypeInfo.As.PROPERTY, property="@class")
- public Object message;
- mapper.readValue(data, Object.class);
Burp plugins
Exploits
FasterXML
Liferay
Vulnerable apps (without public sploits/need more info):
Apache Camel
Fastjson (JSON)
How it works:
Detect
Code review
- com.alibaba.fastjson.JSON
- JSON.parseObject
Burp plugins
Payload generators
Genson (JSON)
How it works:
Detect
Code review
- com.owlike.genson.Genson
- useRuntimeType
- genson.deserialize
Burp plugins
Flexjson (JSON)
How it works:
Payload generators / gadget chains
Detect
Code review
- import flexjson.JSONDeserializer
- JSONDeserializer jsonDeserializer = new JSONDeserializer()
- jsonDeserializer.deserialize(jsonString);
Exploits
Liferay
Jodd (JSON)
vulnerable in a non-default configuration when setClassMetadataName() is set
Payload generators / gadget chains
Detect
Code review
- com.fasterxml.jackson.databind.ObjectMapper
- JsonParser jsonParser = new JsonParser()
- jsonParser.setClassMetadataName("class").parse(jsonString, ClassName.class);
Red5 IO AMF (AMF)
How it works:
Payload generators
Detect
Code review
- org.red5.io
- Deserializer.deserialize(i, Object.class);
Burp plugins
Vulnerable apps (without public sploits/need more info):
Apache OpenMeetings
Apache Flex BlazeDS (AMF)
How it works:
Payload generators
Detect
Code review
Burp plugins
Vulnerable apps:
Oracle Business Intelligence
Adobe ColdFusion
Draytek VigorACS
Apache BlazeDS
VMWare VCenter
HP Systems Insight Manager
Flamingo AMF (AMF)
How it works:
Detect
Burp plugins
GraniteDS (AMF)
How it works:
Detect
Burp plugins
WebORB for Java (AMF)
How it works:
Detect
Burp plugins
SnakeYAML (YAML)
How it works:
Payload generators
Detect
Code review
- org.yaml.snakeyaml.Yaml
- yaml.load
Burp plugins
Vulnerable apps (without public sploits/need more info):
Resteasy
Apache Camel
Apache Brooklyn
Apache ShardingSphere
jYAML (YAML)
How it works:
Payload generators
Detect
- org.ho.yaml.Yaml
- Yaml.loadType(data, Object.class);
Burp plugins
YamlBeans (YAML)
How it works:
Payload generators
Detect
- com.esotericsoftware.yamlbeans
- YamlReader r = new YamlReader(data, yc);
Burp plugins
"Safe" deserialization
Some serialization libs are safe (or almost safe) https://github.com/mbechler/marshalsec
However, it's not a recommendation, but just a list of other libs that has been researched by someone:
- JAXB
- XmlBeans
- Jibx
- Protobuf
- GSON
- GWT-RPC
马建仓 AI 助手