|
3 | 3 | --- |
4 | 4 |
|
5 | 5 | ### fastjson |
| 6 | +##### RCE |
| 7 | +package:com.threedr3am.bug.fastjson.rce |
| 8 | + |
6 | 9 | 1. com.threedr3am.bug.fastjson.rce.FastjsonSerialize(TemplatesImpl) 利用条件:fastjson <= 1.2.24 + Feature.SupportNonPublicField |
7 | 10 | 2. com.threedr3am.bug.fastjson.rce.NoNeedAutoTypePoc 利用条件:fastjson < 1.2.48 不需要任何配置,默认配置通杀RCE |
8 | 11 | 3. com.threedr3am.bug.fastjson.rce.HikariConfigPoc(HikariConfig) 利用条件:fastjson <= 1.2.59 RCE,需要开启AutoType |
9 | 12 | 4. com.threedr3am.bug.fastjson.rce.CommonsProxyPoc(SessionBeanProvider) 利用条件:fastjson <= 1.2.61 RCE,需要开启AutoType |
| 13 | +5. com.threedr3am.bug.fastjson.rce.JndiConverterPoc(JndiConverter) 利用条件:fastjson <= 1.2.62 RCE,需要开启AutoType |
| 14 | +6. com.threedr3am.bug.fastjson.rce.HadoopHikariPoc(HikariConfig) 利用条件:fastjson <= 1.2.62 RCE,需要开启AutoType |
| 15 | +7. com.threedr3am.bug.fastjson.rce.IbatisSqlmapPoc(JtaTransactionConfig) 利用条件:fastjson <= 1.2.62 RCE,需要开启AutoType |
| 16 | + |
| 17 | +##### SSRF |
| 18 | +package:com.threedr3am.bug.fastjson.ssrf |
| 19 | + |
| 20 | +1. com.threedr3am.bug.fastjson.ssrf.ApacheCxfSSRFPoc(WadlGenerator) 利用条件:fastjson <= 1.2.66 SSRF,需要开启AutoType |
| 21 | +2. com.threedr3am.bug.fastjson.ssrf.ApacheCxfSSRFPoc2(SchemaHandler) 利用条件:fastjson <= 1.2.66 SSRF,需要开启AutoType |
| 22 | +3. com.threedr3am.bug.fastjson.ssrf.CommonsJellySSRFPoc(Embedded) 利用条件:fastjson <= 1.2.66 SSRF,需要开启AutoType |
| 23 | +4. com.threedr3am.bug.fastjson.ssrf.JREJeditorPaneSSRFPoc(JEditorPane) 利用条件:fastjson <= 1.2.66 SSRF,需要开启AutoType |
10 | 24 |
|
11 | 25 | --- |
12 | 26 |
|
13 | 27 | ### jackson |
14 | | -package:com.threedr3am.bug.jackson |
| 28 | +##### RCE |
| 29 | +package:com.threedr3am.bug.jackson.rce |
| 30 | + |
| 31 | +1. com.threedr3am.bug.jackson.rce.AnterosPoc |
| 32 | +2. com.threedr3am.bug.jackson.rce.EhcacheJndi |
| 33 | +3. com.threedr3am.bug.jackson.rce.H2Rce |
| 34 | +4. com.threedr3am.bug.jackson.rce.HadoopHikariConfigPoc |
| 35 | +5. com.threedr3am.bug.jackson.rce.HikariConfigPoc |
| 36 | +6. com.threedr3am.bug.jackson.rce.IbatisSqlmapPoc |
| 37 | +7. com.threedr3am.bug.jackson.rce.JndiConverterPoc |
| 38 | +8. com.threedr3am.bug.jackson.rce.LogbackJndi |
| 39 | + |
| 40 | +##### SSRF |
| 41 | +package:com.threedr3am.bug.jackson.ssrf |
15 | 42 |
|
16 | 43 | --- |
17 | 44 |
|
@@ -72,4 +99,7 @@ cas相关漏洞 |
72 | 99 |
|
73 | 100 | --- |
74 | 101 |
|
75 | | -### spring |
| 102 | +### spring |
| 103 | +1. spring-actuator(jolokia、snake-yaml、h2-hikariCP、eureka) |
| 104 | +2. spring-cloud-config-server(CVE-2019-3799) |
| 105 | +3. spring-cloud-config-server(CVE-2020-5405) |
0 commit comments