Shiro 550 Deserialization Vulnerability Analysis and Exploitation Techniques
Understanding the Shiro Framework 550 Deserialization Vulnerability
Environment Setup
Required components: Shiro source code, JDK 8, Tomcat
Vulnerability Root Cause
The vulnerability affects Shiro versions <= 1.2.24, though higher vertions may also be vulnerable if developers configure hardcoded keys. The security flaw exists in the Remember ...
Posted on Thu, 30 Jul 2026 17:02:25 +0000 by railanc4309
Analyzing the Apache Commons Collections LazyMap Deserialization Gadget Chain
Core Mechanism and Call Flow
The sixth widely recognized gadget chain in Apache Commons Collections exploits the interplay between LazyMap and TiedMapEntry to achieve arbitrary code execution during Java object deserialization. Unlike earlier implementations that rely on JDK-specific quirks or dynamic proxies, this path leverages standard colle ...
Posted on Mon, 20 Jul 2026 17:08:40 +0000 by tmharrison
Deep Dive into Apache Commons Collections Deserialization Chains: CC5 and CC7 Mechanics
Target Environment
The demonstration relies on the following library versions and runtime configurations:
Library: Apache Commons Collections 3.2.1
Runtime: OpenJDK 1.8 (Update 65)
Both vulnerabilities involve modifications within the LazyMap.get() method. The following sections detail the execution flow and implementation for the CC5 and CC7 ...
Posted on Fri, 10 Jul 2026 17:12:22 +0000 by richei
Understanding the Commons Collections 1 Deserialization Chain
Environment Setup
The CC1 gadget chain was patched in JDK 8u71 and later. Therefore, we need a JDK version prior to that. This analysis uses JDK 8u66. To obtain the required source files (especially for sun.reflect.annotation.AnnotationInvocationHandler), follow these steps:
Download the vulnerable JDK version from this OpenJDK changeset and e ...
Posted on Tue, 07 Jul 2026 17:25:29 +0000 by mpower