cve/2016/CVE-2016-5003.md

CVE-2016-5003

Description

The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an ex:serializable element.

POC

Reference

• http://www.openwall.com/lists/oss-security/2020/01/24/2
• http://www.openwall.com/lists/oss-security/2020/01/24/2

Github

• https://github.com/PalindromeLabs/Java-Deserialization-CVEs
• https://github.com/fbeasts/xmlrpc-common-deserialization
• https://github.com/gteissier/xmlrpc-common-deserialization
• https://github.com/slowmistio/xmlrpc-common-deserialization