Phying News
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dojo challenge #48 RubitMQ solution

Summary

Dojo #48: Oj.load's unrestricted object mode lets crafted JSON instantiate a gadget class whose find command executes arbitrary shell through -exec — deserialization to RCE in one chain.
Published
Collected

original ↗

Related coverage

back