Home

Awesome

Java Unmarshaller Security - Turning your data into code execution

If you came here for Log4Shell/CVE-2021-44228, you may want to read about the exploitation vectors and affected Java runtime versions: https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/

Paper

It's been more than two years since Chris Frohoff and Garbriel Lawrence have presented their research into Java object deserialization vulnerabilities ultimately resulting in what can be readily described as the biggest wave of remote code execution bugs in Java history.

Research into that matter indicated that these vulnerabilities are not exclusive to mechanisms as expressive as Java serialization or XStream, but some could possibly be applied to other mechanisms as well.

This paper presents an analysis, including exploitation details, of various Java open-source marshalling libraries that allow(ed) for unmarshalling of arbitrary, attacker supplied, types and shows that no matter how this process is performed and what implicit constraints are in place it is prone to similar exploitation techniques.

Full paper is at marshalsec.pdf

Disclaimer

All information and code is provided solely for educational purposes and/or testing your own systems for these vulnerabilities.

Usage

Java 8 required. Build using maven mvn clean package -DskipTests. Run as

java -cp target/marshalsec-[VERSION]-SNAPSHOT-all.jar marshalsec.<Marshaller> [-a] [-v] [-t] [<gadget_type> [<arguments...>]]

where

Payload generators for the following marshallers are included:<br />

MarshallerGadget Impact
BlazeDSAMF(0|3|X)JDK only escalation to Java serialization<br/>various third party libraries RCEs
Hessian|Burlapvarious third party RCEs
Castordependency library RCE
Jacksonpossible JDK only RCE, various third party RCEs
Javayet another third party RCE
JsonIOJDK only RCE
JYAMLJDK only RCE
Kryothird party RCEs
KryoAltStrategyJDK only RCE
Red5AMF(0|3)JDK only RCE
SnakeYAMLJDK only RCEs
XStreamJDK only RCEs
YAMLBeansthird party RCE

Arguments and additional prerequisites

System Command Execution

No prerequisites.

Remote Classloading (plain)

Prerequisites:

Remote Classloading (ServiceLoader)

The service to load is currently hardcoded to javax.script.ScriptEngineFactory.

Prerequisites:

JNDI Reference indirection

Prerequisites:

Running tests

There are a couple of system properties that control the arguments when running tests (through maven or when using -a)

Tests run with a SecurityManager installed that checks for system command execution as well as code executing from remote codebases. For that to work the loaded class in use must trigger some security manager check.