File size: 653 Bytes
58fe8fa | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 | ---
name: deserialization-java
domain: web
triggers:
languages: [java]
severity_focus: [P1, P2, P3]
---
# deserialization-java
Java deserialization: ObjectInputStream gadgets (CommonsCollections, Spring, Hibernate, JRE7u21), ysoserial chains, Jackson polymorphic typing, SnakeYAML default tag, JNDI gadgets via LDAP/RMI.
## Detection checklist
- enumerate exposure
- match canonical sinks
- confirm reproducibility
- map to CWE / OWASP / CVSS
## Exploitation primitives
- reproduce in lab
- minimise the PoC
- assess blast radius
## Reporting fingerprint
- include affected version range
- include suggested fix snippet
- include CVSS 3.1 vector
|