Later archive addition
Jackson gadgets - Anatomy of a vulnerability
The article develops a Jackson polymorphic-deserialization gadget using Logback’s JDBC connection source, first yielding SSRF through attacker-controlled JDBC URLs. When H2 is present, its remote initialization script and Java alias features extend the chain to code execution; the authors also describe an iterative static taint-analysis tool for gadget discovery.
Record
- Researcher
- Andrea Brancaleoni
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Andrea Brancaleoni, first published at the original source. Preserved copies are kept so the citation survives its host.