Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2020-2950 — Proof-of-concept exploit for CVE-2020-2950, demonstrating AMF deserialization to Java deserialization in Oracle Business Intelligence, with debug trace and payload. | Kitploit
Tools/GitHubGitHub/tuo4n8/cve-2020-2950
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingBinary Analysis
GitHubtuo4n8/cve-2020-2950

CVE-2020-2950

Proof-of-concept exploit for CVE-2020-2950, demonstrating AMF deserialization to Java deserialization in Oracle Business Intelligence, with debug trace and payload.

View Repository
195 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Oracle-BI (CVE-2020-2950)

AMF deseiralize

Version: 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0

**Install:**https://www.sql.edu.vn/obiee/oracle-business-intelligence-12c/

Ref: https://peterjson.medium.com/cve-2020-2950-turning-amf-deserialize-bug-to-java-deserialize-bug-2984a8542b6f

Exploit - PoC

amf.bin

Header cmd with base64 and child !!

Debug trace bug

URL: /analytics/jbips/messagebroker/cs/

  • Handle request -> processCall()

image-20210521104317854

  • Get inputstream -> deserialize AMF package

image-20210521104423834

  • Get Object AMF -> deserilize

image-20210521104538758

image-20210521104730919

image-20210521104755256

image-20210521104844150

  • If matching type -> AMF readobject (AMF3DATA.class)

image-20210521104956342

  • AMF3DATA.class -> AMF3ObjectInput
  • In AMF3ObjectInut -> readComplexObject

image-20210521105409912

  • In readComplexObject:
    • If class deseriliaze is externalizable -> radExternalchain
    • else setFiled

image-20210521105523270

  • AMF deserialize chain -> readExternal Chain
Download Tool