Jackson Java Deserialization Vulnerabilities
Very detailed information about the vulnerabilities
is available here,
here
and here.
To summarize, the java code is vulnerable if following strings are present in
code:
- enableDefaultTyping
- @JsonTypeInfo
(per-class annotations)
No comments:
Post a Comment