Improper access control in Apache Commons BeanUtils enum property handling

This repository is a small, self-contained lab exploit package for chaining CVE-2025-48734 in Apache Commons BeanUtils into remote code execution under additional unsafe conditions. It contains two files: a README describing the vulnerability, lab topology, attack phases, and mitigations; and a Bash setup script, kali-lab-tools.sh, which installs dependencies, downloads ysoserial, and generates the actual exploit driver exploit.sh. The exploit capability is multi-stage and operational rather than a simple detector. Phase 1 verifies that a target property endpoint allows traversal from an enum field to status.declaringClass and then to status.declaringClass.classLoader, confirming the BeanUtils information leak / traversal primitive. Phase 2 abuses indexed access to classLoader.URLs[n] to enumerate runtime classpath entries and specifically checks for commons-collections-3.x, which would enable a deserialization gadget chain. Phase 3 fuzzes several likely POST endpoints using Java serialization magic bytes (AC ED 00 05) to identify an endpoint that appears to deserialize attacker-controlled objects. Phase 4 invokes ysoserial to generate a CommonsCollections6 payload containing an arbitrary command and POSTs the serialized object to the discovered endpoint. The intended result is arbitrary command execution during deserialization. Repository structure is minimal: README.md is documentation only, while kali-lab-tools.sh is the main code file and entry point. That script defaults to target 10.211.55.10:8080, creates $HOME/lab-tools, installs curl/python3/default-jdk, downloads ysoserial-all.jar from GitHub, and writes a second executable exploit.sh containing the full attack logic. The exploit is aimed at a lab Spring Boot application exposing /api/property and an unsafe deserialization endpoint such as /api/data/import. It is not framework-based, not fake, and not merely a detection script, because it includes payload generation and delivery for command execution.

This repository is a small, self-contained lab exploit project with 2 files: a README describing the vulnerability chain and one Bash script, kali-lab-tools.sh, that installs attacker-side dependencies and generates the actual exploit script exploit.sh. There is no framework involvement; the repository is a standalone Bash-based operational proof-of-concept. The exploit targets CVE-2025-48734 in Apache Commons BeanUtils, specifically unsafe nested property traversal that exposes enum.declaringClass and then classLoader. The code does not treat the CVE as direct RCE; instead it uses it as a reconnaissance primitive to confirm ClassLoader access and enumerate loaded JARs. It then checks for the presence of Commons Collections 3.x as a deserialization gadget prerequisite. The generated exploit.sh performs a five-stage chain: (1) probe /api/property to confirm access to status.declaringClass and status.declaringClass.classLoader, (2) iterate classLoader.URLs[n] through /api/property to enumerate classpath entries and detect commons-collections-3, (3) fuzz several likely POST endpoints for Java deserialization behavior using the Java serialization magic bytes 0xACED0005, (4) generate a ysoserial CommonsCollections6 payload with an attacker-supplied command, and (5) POST the serialized payload to the discovered endpoint for command execution. Repository structure is simple: README.md provides the attack narrative, prerequisites, example vulnerable endpoints, and mitigation guidance; kali-lab-tools.sh is the only code file and serves as the setup/launcher for the attack tooling. The script installs curl, python3, and default-jdk, downloads ysoserial from GitHub, and writes exploit.sh to disk. The exploit is therefore operational rather than a mere detector, because it includes payload generation and delivery for arbitrary command execution when the target environment satisfies all required conditions.