> We can’t see a path to exploit this without a valid private key. On paper, that should kill the bug dead. The juicy theory bit: The vendor accidentally signed evil. Imagine this: When you activate your GoAnywhere product, your installation generates a serialized license request. It’s sent to the vendor’s license server (my.goanywhere.com) If someone slipped a malicious object inside that request and the vendor blin…
So would the signed 'object' contain code? Or is it just data? And even if it is code, does deserializing mean execution? I guess it could mean execution at some other stage in the process. What is the end-goal of this... would it be data exfiltration vs ransomware.
That means if the shape of your object is something like
class Foo implements Serializable {
SerializableFunction bar;
void doBar() {
bar.apply();
}
}
Here's an article detailing exactly how that works: https://www.baeldung.com/java-serialize-lambda