yaml-payload

yaml-payload 一个用于 CVE-2022-1471 的 SnakeYAML 反序列化利用 payload，改编自 artsploit/yaml-payload（最初基于 mbechler/marshalsec）。 功能 当通过 SnakeYAML 不安全的 Yaml.load 加载时，此 payload 会接管正在运行的应用程序 ，并用一个 "You've Been PWNED" 页面替换它： 1. 通过反射将 Tomcat Valve 注入 到正在运行的 Spring Boot 应用中，劫持现有的 8080 端口 —— 相同的 URL（包括任何 ngrok 隧道）现在会提供...

yaml-payload-2

yaml-payload 一个针对 CVE-2022-1471 的 SnakeYAML 反序列化利用载荷，改编自 artsploit/yaml-payload（最初基于 mbechler/marshalsec）。 功能说明 当通过 SnakeYAML 不安全的 Yaml.load 加载时，此载荷会接管正在运行的应用程序 ，并将其替换为“You've Been PWNED”页面： 1. 注入 Tomcat Valve — 通过反射将 Valve 注入到正在运行的 Spring Boot 应用中，劫持现有的 8080 端口——相同的 URL（包括任何 ngrok 隧道）现在都会提供 PWNE...

seans-surf-and-skate

Sean's Surf & Skate Co. — Seal Security Demo Maven / Java A small but real-looking e-commerce storefront "Sean's Surf & Skate Co." built with Spring Boot. It ships with known-vulnerable open-source dependencies so it can be used to demonstrate how Seal Security remediates CVEs with backported...

CVE-2023-38647

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run...

CVE-2021-21249 Post-Auth Unsafe Yaml deserialization

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default when not using SafeConstructor allows the...

OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794)

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries...

OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794)

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries...

OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794)

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries...

Oracle Java ScriptEngineManager Sandbox Bypass Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ScriptEngineManager...

OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794)

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries...

OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794)

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries...

OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794)

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries...

OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794)

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries...

OpenJDK: Better ScriptEngineManager ScriptEngine management (Libraries, 8036794)

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries...