CVE-2017-7525 Java Insecure Deserialization Lab

Basic Java REST application vulnerable to Insecure Deserialization, leading to RCE.

The project must be run on Java < 8u45

Based on Maven with the following dependencies:

More dependencies can be added through Maven if you want to try some more gadgets.

Running

Open (recommended with Intellij Idea) and run the Java class in src/main/java/com/deserialization/lab/Main.java.

GET /api/message : returns a serialized object useful to build a payload
POST /api/message : Accepts a payload, deserializes it and reflects the generated instance as response

The application is actually vulnerable to almost all the Jackson Databind CVEs.

check