Hugging Face's logo

Spaces:
Architect8999
/
rhodawk-ai-devops-engine
Sleeping

App Files Community
rhodawk-ai-devops-engine / architect /skills /web /deserialization-java.md
Rhodawk Agent
feat(v6): Masterplan build — semantic skill selector, 84 skills, night-hunt orchestrator, OpenClaw gateway, 12 MCP servers, developer playbook
58fe8fa
preview code
|
Raw
History Blame Contribute Delete
653 Bytes
metadata 
name: deserialization-java
domain: web
triggers:
  languages:
    - java
severity_focus:
  - P1
  - P2
  - P3

deserialization-java

Java deserialization: ObjectInputStream gadgets (CommonsCollections, Spring, Hibernate, JRE7u21), ysoserial chains, Jackson polymorphic typing, SnakeYAML default tag, JNDI gadgets via LDAP/RMI.

Detection checklist

  • enumerate exposure
  • match canonical sinks
  • confirm reproducibility
  • map to CWE / OWASP / CVSS

Exploitation primitives

  • reproduce in lab
  • minimise the PoC
  • assess blast radius

Reporting fingerprint

  • include affected version range
  • include suggested fix snippet
  • include CVSS 3.1 vector