Jackson Databind HikariConfig Polymorphic Deserialization

This repository provides a working exploit for CVE-2019-14540, targeting Java applications using vulnerable versions of the Jackson and Fastjson libraries in conjunction with JDK versions less than 8u191. The exploit leverages insecure deserialization and JNDI LDAP remote class loading to achieve remote code execution. The structure includes a main exploit driver (Main.java) that demonstrates both Jackson and Fastjson deserialization vectors, and a payload (Exploit.java) that, when loaded remotely, executes a system command to launch the calculator application on the victim's machine. The attack requires the attacker to run a malicious LDAP server (using marshalsec) and an HTTP server to serve the payload class file. The endpoints used in the exploit are 'ldap://localhost:1389/Exploit' for JNDI injection and 'http://127.0.0.1:8000/#Exploit' for serving the payload. The repository is well-structured for demonstration purposes and includes build scripts and documentation for setup and execution.