| शीर्षक | vhr人事管理系统 1.0-SNAPSHOT Deserialization |
|---|
| विवरण | vhr（微人事） — Spring AMQP Java Deserialization RCE
Product: vhr（微人事） 1.0-SNAPSHOT
Classification: Deserialization of Untrusted Data
=== ROOT CAUSE ===
`RabbitConfig` uses default `SimpleMessageConverter`; `MailReceiver` deserializes untrusted bytes.
=== REPRODUCTION ===
mailserver consumes `javaboy.mail.queue` with default Java serialization. Publishing malicious serialized objects causes RCE on mailserver JVM host.
PoC:
# Publish Java Chains payload to queue javaboy.mail.queue (port 5673)
python3 vhr_rabbitmq_publish.py --host TARGET --port 5673 --file vhr_payload_touch.b64
# Verify on mailserver host: ls /tmp/vhr_deser_poc_ok
Expected: File `/tmp/vhr_deser_poc_ok` created on mailserver host (not RabbitMQ container)
=== IMPACT ===
Remote code execution on mailserver application server.
=== FIX ===
Use JSON message converter; authenticate RabbitMQ; restrict network access.
|
|---|
| स्रोत | ⚠️ https://github.com/ArrestX/vhr-advisories/blob/main/poc/VHR-VULN-006/YAKIT-PoC.md |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 14/07/2026 11:04 AM (2 महीनों पहले) |
|---|
| संयम | 12/09/2026 10:04 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403078 [lenve vhr 1.0-SNAPSHOT MailReceiver अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|