2 ms·
the library parses logged messages for commands, which include a command which can be used for "connect to this server, download code from there, run it". To ex
by detaro 5y ago
the library parses logged messages for commands, which include a command which can be used for "connect to this server, download code from there, run it". To exploit it, put such a command into any place the app will write to log.
- layer8 5y agoActually, the command is "download this serialized Java object", and the server serving the object can add "by the way, you will need these classes for deserializing the object", and the client "ok, I’ll download those as well then", and upon deserializing the object, code from the downloaded classes is run (the actual RCE) in order to initialize the class and deserialize the instance.