A cheat sheet for pentesters and researchers about deserialization vulnerabilities in various Java (JVM) serialization libraries.

Please, use #javadeser hash tag for tweets.

• Java Native Serialization (binary)
  • Overview
  • Main talks & presentations & docs
  • Payload generators
  • Exploits
  • Detect
  • Vulnerable apps (without public sploits/need more info)
  • Protection
  • For Android
• XMLEncoder (XML)
• XStream (XML/JSON/various)
• Kryo (binary)
• Hessian/Burlap (binary/XML)
• Castor (XML)
• json-io (JSON)
• Jackson (JSON)
• Fastjson (JSON)
• Genson (JSON)
• Red5 IO AMF (AMF)
• Apache Flex BlazeDS (AMF)
• Flamingo AMF (AMF)
• GraniteDS (AMF)
• WebORB for Java (AMF)
• SnakeYAML (YAML)
• jYAML (YAML)
• YamlBeans (YAML)
• "Safe" deserialization

• Java Deserialization Security FAQ
• From Foxgloves Security

by @frohoff & @gebl

• Video
• Slides
• Other stuff

by @matthias_kaiser

• Video

by @pwntester & @cschneider4711

• Slides
• White Paper
• Bypass Gadget Collection

by @frohoff & @gebl

• Slides

by @cschneider4711 & @pwntester

• Slides
• Video
• PoC for Scala, Grovy

by @matthias_kaiser

• Slides

by @matthias_kaiser

• Slides
• White Paper
• Tool for jms hacking

by @lucacarettoni

• Slides

by @pwntester and O. Mirosh

• Slides
• White Paper

by @e_rnst

• Slides+Source

by deadcode.me

• Part I - Commons Gadgets
• Part II - exploitation rev 2

by @joaomatosf

• Slides
• Examples

by @ianhaken

• Video
• Slides
• Tool

https://github.com/frohoff/ysoserial

ysoserial 0.6 payloads:

payload	author	dependencies	impact (if not RCE)
BeanShell1	@pwntester, @cschneider4711	bsh:2.0b5
C3P0	@mbechler	c3p0:0.9.5.2, mchange-commons-java:0.2.11
Clojure	@JackOfMostTrades	clojure:1.8.0
CommonsBeanutils1	@frohoff	commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
CommonsCollections1	@frohoff	commons-collections:3.1
CommonsCollections2	@frohoff	commons-collections4:4.0
CommonsCollections3	@frohoff	commons-collections:3.1
CommonsCollections4	@frohoff	commons-collections4:4.0
CommonsCollections5	@matthias_kaiser, @jasinner	commons-collections:3.1
CommonsCollections6	@matthias_kaiser	commons-collections:3.1
CommonsCollections7	@scristalli, @hanyrax, @EdoardoVignati	commons-collections:3.1
FileUpload1	@mbechler	commons-fileupload:1.3.1, commons-io:2.4	file uploading
Groovy1	@frohoff	groovy:2.3.9
Hibernate1	@mbechler
Hibernate2	@mbechler
JBossInterceptors1	@matthias_kaiser	javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
JRMPClient	@mbechler
JRMPListener	@mbechler
JSON1	@mbechler	json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
JavassistWeld1	@matthias_kaiser	javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
Jdk7u21	@frohoff
Jython1	@pwntester, @cschneider4711	jython-standalone:2.5.2
MozillaRhino1	@matthias_kaiser	js:1.7R2
MozillaRhino2	@_tint0	js:1.7R2
Myfaces1	@mbechler
Myfaces2	@mbechler
ROME	@mbechler	rome:1.0
Spring1	@frohoff	spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
Spring2	@mbechler	spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
URLDNS	@gebl		jre only vuln detect
Vaadin1	@kai_ullrich	vaadin-server:7.7.14, vaadin-shared:7.7.14
Wicket1	@jacob-baines	wicket-util:6.23.0, slf4j-api:1.6.4

Additional tools (detection, integration ysoserial with Burp Suite):

• Freddy
• JavaSerialKiller
• Java Deserialization Scanner
• Burp-ysoserial
• SuperSerial
• SuperSerial-Active

Additional tool to test RMI:

• BaRMIe
• Barmitza

Full shell (pipes, redirects and other stuff):

• $@|sh – Or: Getting a shell environment from Runtime.exec
• Set String[] for Runtime.exec (patch ysoserial's payloads)
• Shell Commands Converter

How it works:

• https://blog.srcclr.com/commons-collections-deserialization-vulnerability-research-findings/
• http://gursevkalra.blogspot.ro/2016/01/ysoserial-commonscollections1-exploit.html

https://github.com/pwntester/JRE8u20_RCE_Gadget

Pure JRE 8 RCE Deserialization gadget

https://github.com/GrrrDog/ACEDcup

File uploading via:

• Apache Commons FileUpload <= 1.3 (CVE-2013-2186) and Oracle JDK < 7u40

https://gist.github.com/coekie/a27cc406fc9f3dc7a70d

Won't fix DoS via default Java classes (JRE)

https://github.com/topolik/ois-dos/

How it works:

• Java Deserialization DoS - payloads

Won't fix DoS using default Java classes (JRE)

• CVE-2018-2677

• Gadget Inspector

no spec tool - You don't need a special tool (just Burp/ZAP + payload)

• Protocol
• Default - 1099/tcp for rmiregistry

ysoserial (works only against a RMI registry service)

• Protocol based on RMI
• • CVE-2016-3427
• partially patched in JRE

ysoserial

mjet

JexBoss

• When we control an address for lookup of JNDI (context.lookup(address) and can have backconnect from a server
• Full info
• JNDI remote code injection

https://github.com/zerothoughts/jndipoc

• Full info

JMET

• if no encryption or good mac

no spec tool

JexBoss

• Protocol
• Default - 7001/tcp on localhost interface
• CVE-2015-4852
• Blacklist bypass - CVE-2017-3248
• Blacklist bypass - CVE-2017-3248 PoC
• Blacklist bypass - CVE-2018-2628
• Blacklist bypass - CVE-2018-3245
• Blacklist bypass - CVE-2018-3191
• CVE-2019-2725

loubia (tested on 11g and 12c, supports t3s)

JavaUnserializeExploits (doesn't work for all Weblogic versions)

WLT3Serial

CVE-2018-2628 sploit

• auth required
• How it works
• CVE-2018-3252

• wsadmin
• Default port - 8880/tcp
• CVE-2015-7450

JavaUnserializeExploits

serialator

CoalfireLabs/java_deserialization_exploits

• When using custom form authentication
• WASPostParam cookie
• Full info

no spec tool

• http://jboss_server/invoker/JMXInvokerServlet
• Default port - 8080/tcp
• CVE-2015-7501

JavaUnserializeExploits

https://github.com/njfox/Java-Deserialization-Exploit

serialator

JexBoss

• http://jboss_server/invoker/readonly
• Default port - 8080/tcp
• CVE-2017-12149
• JBoss 6.X and EAP 5.X
• Details

no spec tool

• http://jboss_server/jbossmq-httpil/HTTPServerILServlet/
• <= 4.x
• CVE-2017-7504

no spec tool

• Jenkins CLI
• Default port - High number/tcp
• CVE-2015-8103
• CVE-2015-3253

JavaUnserializeExploits

JexBoss

• patch "bypass" for Jenkins
• CVE-2016-0788
• Details of exploit

ysoserial

• Jenkins CLI LDAP
• *Default port - High number/tcp
• <= 2.32
• <= 2.19.3 (LTS)
• CVE-2016-9299

• <= 2.32.1
• CVE-2017-1000353
• Details

Sploit

• <= 2.1.2
• When Rest API accepts serialized objects (uses ObjectRepresentation)

no spec tool

• *When Rest API accepts serialized objects (uses @Consumes({"*/*"}) or "application/*" )
• Details and examples

no spec tool

• RMI

ysoserial

• all versions
• RMI

ysoserial

• CVE-2015-7253
• Serialized object in cookie

no spec tool

• /servlet/ConsoleServlet?ActionType=SendStatPing
• CVE-2015-6555

serialator

• https://[target]:18443/v3/dataflow/0/0
• CVE-2016-3461

no spec tool

serialator

• custom(?) protocol (1337/tcp)
• MSA-2016-01

powerfolder-exploit-poc

• <= 6.3.1
• RMI
• CVE-2016-3642

ysoserial

• https://[target]/xmp_data_handler_service/xmpDataOperationRequestServlet
• <= 2.2.3 Update 4
• <= 3.0.2
• CVE-2016-1291

CoalfireLabs/java_deserialization_exploits

• <= 5.8.0.32.2
• RMI (2020 tcp)
• CSCux34781

ysoserial

• all version, no fix (the project is not supported)
• POST XML request with ex:serializable element
• Details and examples

no spec tool

• because it uses Apache XML-RPC
• CVE-2016-5004
• Details and examples

no spec tool

• https://[target]/developmentserver/metadatauploader
• CVE-2017-9844

PoC

• admin panel for Solaris
• < v3.1.
• old DoS sploit

no spec tool

• 1.0.0 <= version < 1.0.13
• 1.2.1 <= version < 1.2.14
• 2.0.0 <= version < 2.0.1
• 2.1.0 <= version < 2.1.1
• it does not check MAC
• CVE-2016-5019

no spec tool

• JMX
• Patch bypass
• CVE-2016-8735

JexBoss

• version 4.x
• CVE-2017-5586

exploit

• /api/spring
• /api/liferay
• <= 7.0-ga3
• if IP check works incorrectly
• Details

no spec tool

• /UFC
• <= 6.7.0
• Details

PoC

• version: 12, 13
• RMI
• CVE-2016-9498

ysoserial

• SHIRO-550
• encrypted cookie (with the hardcoded key)
• Exploitation (in Chinese)

• WebDMDebugServlet
• <= 7.3 E0504P2
• CVE-2017-12557

Metasploit module

• RMI
• <= 7.3 E0504P2
• CVE-2017-5792

ysoserial

• JMS

JMET

• JMS

JMET

• JMS

JMET

• JMS

JMET

• JMS

JMET

• JMS

JMET

• JMS

JMET

• JMS

JMET

• JMS

JMET

• JMS

JMET

• JMS

JMET

• JMS

JMET

• All version (this was deemed by design by project maintainer)
• Binary
• Default port : 5001
• Info : https://axis.apache.org/axis2/java/core/docs/soapmonitor-module.html

java -jar ysoserial-*-all.jar CommonsCollections1 'COMMAND_HERE' | nc TARGET_SERVER 5001

ysoserial

• <= 3.0.1
• RMI
• Exploit

ysoserial

• <= 3.0.1
• RMI
• When using Distributed Test only
• Exploit

ysoserial

• <= 1.4.0
• JNDI injection
• /jolokia/
• Exploit

• all versions
• Poor RichFaces
• When EL Injection meets Java Deserialization

• < 3.0.1
• Analysis of CVE-2017-12628

ysoserial

• <= Oracle 12C
• CVE-2018-3004 - Oracle Privilege Escalation via Deserialization

• ObjectInputStream.readObject
• ObjectInputStream.readUnshared
• Tool: Find Security Bugs
• Tool: Serianalyzer

• Magic bytes 'ac ed 00 05' bytes
• 'rO0' for Base64
• 'application/x-java-serialized-object' for Content-Type header

• Nmap >=7.10 has more java-related probes
• use nmap --all-version to find JMX/RMI on non-standart ports

• JavaSerialKiller
• Java Deserialization Scanner
• Burp-ysoserial
• SuperSerial
• SuperSerial-Active
• Freddy

• Details

• info from slides

• SOLR-8262

• 5.1 <= version <=5.4

• /stream handler uses Java serialization for RPC

• SOLR-13301

• Attack via jmx.serviceUrl

• CVE-2019-0192

• CVE-2015-5254
• <= 5.12.1
• Explanation of the vuln
• CVE-2015-7253

• CVE-2015-6576
• 2.2 <= version < 5.8.5
• 5.9.0 <= version < 5.9.7

• CVE-2015-8360
• 2.3.1 <= version < 5.9.9
• Bamboo JMS port (port 54663 by default)

• only Jira with a Data Center license
• RMI (port 40001 by default)
• JRA-46203

• version < 2.4.17
• "an ActorSystem exposed via Akka Remote over TCP"
• Official description

• CVE-2016-2173
• 1.0.0 <= version < 1.5.5

• CVE-2016-6809
• 1.6 <= version < 1.14
• Apache Tika’s MATLAB Parser

• HBASE-14799

• CVE-2015-5348

• as server
• CVE-2017-5645

• custom(?) protocol(60024/tcp)
• article

• from slides

• CVE-2015-7501

• RHSA-2016-0539
• CVE-2016-2510

• 6.0 <= version < 6.4.0
• REST API
• VMSA-2016-0020
• CVE-2016-7462

• CVE-2015-6934
• VMSA-2016-0005
• JMX

• List of vulnerable products
• CVE-2015-6420

• CVE-2016-1487

• CVE-2015-8765

• CVE-2016-4372

• CVE-2016-1997

• CVE-2016-2000

• CVE-2016-1998

• CVE-2016-1985

• CVE-2016-1999

• CVE-2016-1986

• CVE-2016-2003

• CVE-2016-4385

• CVE-2016-0958

• CVE-2015-8237
• RMI (30xx/tcp)
• CVE-2015-8238
• js-soc protocol (4711/tcp)

• CVE-2016-2170

• requires local access
• CVE-2016-0714
• Article

• CVE-2015-8581
• CVE-2016-0779

• CVE-2012-4858

• ?

• 9-9.5.5, 10.0.0-10.0.2, 10.1.0-Xpress, 11.0.0-11.0.3 and 12.0.0
• 201505-01

• sol30518307

• HS16-010
• 0328_acc

• CVE-2015-8545

• < 8.7.0
• CVE-2016-3415
• <= 8.8.11
• A Saga of Code Executions on Zimbra

• <= 2016 Update 4
• <= 11 update 12
• CVE-2017-11283
• CVE-2017-11284

• RMI
• <= 2016 Update 5
• <= 11 update 13
• Another ColdFusion RCE – CVE-2018-4939
• CVE-2018-4939

• port 45000
• when Clustering is enabled
• Won't Fix (?)
• 10.7 and 10.8
• Citrix advisory
• CVE-2018-10654

• SOAP connector
• <= 9.0.0.9
• <= 8.5.5.14
• <= 8.0.0.15
• <= 7.0.0.45
• CVE-2018-1567

• TCP port 4282
• RMI (?)
• 5.4.x
• CVE-2017-9830
• Details

• CVE-2013-1768

• Look-ahead Java deserialization
• NotSoSerial
• SerialKiller
• ValidatingObjectInputStream
• Name Space Layout Randomization
• Some protection bypasses
• Tool: Serial Whitelist Application Trainer
• JEP 290: Filter Incoming Serialization Data in JDK 6u141, 7u131, 8u121
  • A First Look Into Java's New Serialization Filtering
• AtomicSerial

• One Class to Rule Them All: 0-Day Deserialization Vulnerabilities in Android
• Android Serialization Vulnerabilities Revisited
• A brief history of Android deserialization vulnerabilities

• Android Java Deserialization Vulnerability Tester

How it works:

• http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
• Java Unmarshaller Security

• java.beans.XMLDecoder
• readObject

• Freddy

• <= 10.3.6.0.0
• <= 12.1.3.0.0
• <= 12.2.1.2.0
• <= 12.2.1.1.0
• http://weblogic_server/wls-wsat/CoordinatorPortType
• CVE-2017-3506
• CVE-2017-10271
• Details

Exploit

• priv escalation
• Oracle Privilege Escalation via Deserialization

How it works:

• http://www.pwntester.com/blog/2013/12/23/rce-via-xstream-object-deserialization38/
• http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
• https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream
• Java Unmarshaller Security

• https://github.com/mbechler/marshalsec

• <= 2.3.34
• <= 2.5.13
• REST plugin
• CVE-2017-9805

Exploit

• com.thoughtworks.xstream.XStream
• xs.fromXML(data)

• Freddy

• CVE-2016-5229

• CVE-2017-2608

How it works:

• https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-1-kryo
• Java Unmarshaller Security

• https://github.com/mbechler/marshalsec

• com.esotericsoftware.kryo.io.Input
• SomeClass object = (SomeClass)kryo.readClassAndObject(input);
• SomeClass someObject = kryo.readObjectOrNull(input, SomeClass.class);
• SomeClass someObject = kryo.readObject(input, SomeClass.class);

• Freddy

How it works:

• Java Unmarshaller Security

• https://github.com/mbechler/marshalsec

• com.caucho.hessian.io
• AbstractHessianInput
• com.caucho.burlap.io.BurlapInput;
• com.caucho.burlap.io.BurlapOutput;
• BurlapInput in = new BurlapInput(is);
• Person2 p1 = (Person2) in.readObject();

• Freddy

How it works:

• Java Unmarshaller Security

• https://github.com/mbechler/marshalsec

• org.codehaus.castor
• org.exolab.castor.xml.Unmarshaller
• org.springframework.oxm.Unmarshaller
• Unmarshaller.unmarshal(Person.class, reader)
• unmarshaller = context.createUnmarshaller();
• unmarshaller.unmarshal(new StringReader(data));

• Freddy

• NMS-9100

How it works:

• Java Unmarshaller Security

Exploitation examples:

• Experiments with JSON-IO, Serialization, Mass Assignment, and General Java Object Wizardry
• JSON Deserialization Memory Corruption Vulnerabilities on Android

• https://github.com/mbechler/marshalsec

• com.cedarsoftware.util.io.JsonReader
• JsonReader.jsonToJava

• Freddy

vulnerable in specific configuration

How it works:

• Java Unmarshaller Security
• On Jackson CVEs: Don’t Panic — Here is what you need to know
• Jackson Deserialization Vulnerabilities

• https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/
• https://github.com/mbechler/marshalsec
• blacklist bypass - CVE-2017-17485
• blacklist bypass - CVE-2017-15095

• com.fasterxml.jackson.databind.ObjectMapper
• ObjectMapper mapper = new ObjectMapper();
• objectMapper.enableDefaultTyping();
• @JsonTypeInfo(use=JsonTypeInfo.Id.CLASS, include=JsonTypeInfo.As.PROPERTY, property="@class")
• public Object message;
• mapper.readValue(data, Object.class);

• Freddy

• CVE-2016-8749

How it works (in Chinese):

• https://www.secfree.com/article-590.html
• Official advisory

• com.alibaba.fastjson.JSON
• JSON.parseObject

• Freddy

• https://github.com/iBearcat/Fastjson-Payload

How it works:

• Friday the 13th JSON Attacks

• com.owlike.genson.Genson
• useRuntimeType
• genson.deserialize

• Freddy

How it works:

• Java Unmarshaller Security

• https://github.com/mbechler/marshalsec

• org.red5.io
• Deserializer.deserialize(i, Object.class);

• Freddy

• CVE-2017-5878

How it works:

• AMF – Another Malicious Format
• Java Unmarshaller Security

• https://github.com/mbechler/marshalsec

• Freddy

• CVE-2017-3066

• <= 2016 Update 3

• <= 11 update 11

• <= 10 Update 22

• Exploiting Adobe ColdFusion before CVE-2017-3066

• PoC

• /ACSServer/messagebroker/amf

• at least 2.2.1

• based on CVE-2017-5641

• PoC

• CVE-2017-5641

• based on CVE-2017-5641

How it works:

• AMF – Another Malicious Format

• Freddy

How it works:

• AMF – Another Malicious Format

• Freddy

How it works:

• AMF – Another Malicious Format

• Freddy

How it works:

• Java Unmarshaller Security

• https://github.com/mbechler/marshalsec

• org.yaml.snakeyaml.Yaml
• yaml.load

• Freddy

• CVE-2016-9606

• CVE-2017-3159

• CVE-2016-8744

How it works:

• Java Unmarshaller Security

• https://github.com/mbechler/marshalsec

• org.ho.yaml.Yaml
• Yaml.loadType(data, Object.class);

• Freddy

How it works:

• Java Unmarshaller Security

• https://github.com/mbechler/marshalsec

• com.esotericsoftware.yamlbeans
• YamlReader r = new YamlReader(data, yc);

• Freddy

Some serialization libs are safe (or almost safe) https://github.com/mbechler/marshalsec

However, it's not a recommendation, but just a list of other libs that has been researched by someone:

• JAXB
• XmlBeans
• Jibx
• Protobuf
• GSON
• GWT-RPC