Nytro Posted September 6, 2017 Report Posted September 6, 2017 Java Unmarshaller Security - Turning your data into code execution Paper It's been more than two years since Chris Frohoff and Garbriel Lawrence have presented their research into Java object deserialization vulnerabilities ultimately resulting in what can be readily described as the biggest wave of remote code execution bugs in Java history. Research into that matter indicated that these vulnerabilities are not exclusive to mechanisms as expressive as Java serialization or XStream, but some could possibly be applied to other mechanisms as well. This paper presents an analysis, including exploitation details, of various Java open-source marshalling libraries that allow(ed) for unmarshalling of arbitrary, attacker supplied, types and shows that no matter how this process is performed and what implicit constraints are in place it is prone to similar exploitation techniques. Full paper is at marshalsec.pdf Disclaimer All information and code is provided solely for educational purposes and/or testing your own systems for these vulnerabilities. Usage Java 8 required. Build using maven mvn clean package -DskipTests. Run as java -cp target/marshalsec-0.0.1-SNAPSHOT-all.jar marshalsec.<Marshaller> [-a] [-v] [-t] [<gadget_type> [<arguments...>]] where -a - generates/tests all payloads for that marshaller -t - runs in test mode, unmarshalling the generated payloads after generating them. -v - verbose mode, e.g. also shows the generated payload in test mode. gadget_type - Identifier of a specific gadget, if left out will display the available ones for that specific marshaller. arguments - Gadget specific arguments Payload generators for the following marshallers are included: Marshaller Gadget Impact BlazeDSAMF(0|3|X) JDK only escalation to Java serialization various third party libraries RCEs Hessian|Burlap various third party RCEs Castor dependency library RCE Jackson possible JDK only RCE, various third party RCEs Java yet another third party RCE JsonIO JDK only RCE JYAML JDK only RCE Kryo third party RCEs KryoAltStrategy JDK only RCE Red5AMF(0|3) JDK only RCE SnakeYAML JDK only RCEs XStream JDK only RCEs YAMLBeans third party RCE Sursa: https://github.com/mbechler/marshalsec Quote
