Apache OFBiz XML-RPC Java Deserialization

This module exploits a Java deserialization vulnerability in Apache OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for versions prior to 17.12.01 using the ROME gadget chain. Versions up to 18.12.11 are exploitable utilizing an auth bypass CVE-2023-51467 and use the...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

CVE-2019-17564 FastJson + SpringFramework Gadget for Dubbo 2.7...

Ruby2. X remote code execute vulnerability analysis of the deserialization gadget chain-vulnerability and early warning-the black bar safety net

Description This article will detailed introduction to ruby any deserialization use, at the same time also released the first General-purpose gadget chain, to achieve the Ruby 2. x arbitrary command execution. In the next article, I will explain in detail the deserialization of the problem and Th...

Apache James Deserialization RCE(CVE-2017-12628)

Analysis of CVE-2017-12628 This morning I spotted a tweet mentioning an “Apache James 3.0.1 JMX Server Deserialization” vulnerability, CVE-2017-12628, which caught my eye because I wrote a generic JMX deserialization exploit which is included in my RMI attack tool BaRMIe. A quick search for more...