Description
FF4J 中某接口存在任意类实例化漏洞。在存在特定依赖的情况下，攻击者可构造恶意请求造成远程代码执行。官方已于 https://github.com/ff4j/ff4j/pull/625 中修复该漏洞。
ff4j framework 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://avd.aliyun.com/detail?id=AVD-2022-44262
https://github.com/advisories/GHSA-65hj-9ppw-77xc
https://nvd.nist.gov/vuln/detail/CVE-2022-44262
https://security.snyk.io/vuln/SNYK-JAVA-ORGFF4J-3152484
https://www.cvedetails.com/cve/CVE-2022-44262/
https://pulsesecurity.co.nz/advisories/Insecure-YAML-Deserialisation