search

GrrrDog / Java-Deserialization-Cheat-Sheet

The cheat sheet about Java Deserialization vulnerabilities
3.02k stars 595 forks source link

Added information for the debug tool SOAPMonitor #13

Closed HoLyVieR closed 5 years ago

HoLyVieR commented 5 years ago

This is an easy to exploit deserialization issue in a debug component of Axis and Axis2. Even though it's fixable the maintainer have never wanted to do so. For the reference here's the source of the issue :

http://www.docjar.com/html/api/org/apache/axis2/soapmonitor/servlet/SOAPMonitorService.java.html#251

GrrrDog commented 5 years ago

Cool! Thanks!