Person API
Spring REST API

This section demonstrates the Person API endpoints with different payload formats. The API supports both JSON and YAML formats for creating person records.

API endpoint: /persons
Person Builder
Visual Editor
Get Person
GET
/persons/
Enter a person ID to retrieve their details
Response:
Waiting for request

                                

                            

                        

                    


                    

                        
                        

                            

                                
    
                                    
                                    
                                    
                                

                            

                            

                                

                                    
                                    

                                        

                                            

                                                
                                                
                                                
Please provide a valid JSON payload

                                            

                                            

                                                
                                                
                                            

                                        

                                        

                                            

                                                
Response:

                                                
Waiting for request

                                            

                                            

                                        

                                    


                                    
                                    

                                        

                                            

                                                
                                                
                                                
Please provide a valid YAML payload

                                            

                                            

                                                
                                            

                                        

                                        

                                            

                                                
Response:

                                                
Waiting for request

                                            

                                            

                                        

                                    


                                    
                                    

                                        

                                            

                                                

                                                    
                                                

                                                

                                                    
Jackson Deserialization Vulnerability

                                                    
This demo exploits CVE-2020-9547 using polymorphic type handling in jackson-databind with the AnterosDBCPConfig gadget.

                                                

                                            

                                        

                                        

                                            

                                                
                                                
                                            

                                            

                                                
                                                
                                            

                                        

                                        

                                            

                                                
Response:

                                                
Waiting for request

                                            

                                            

                                        

                                    

                                

                            

                        


                        
                        

                            

                                
API Information

                            

                            

                                

                                    

                                        

                                            
                                        

                                        

                                            

                                                

                                                    
                                                        

                                                            Method
                                                            URL
                                                            Description
                                                        

                                                    
                                                    
                                                        

                                                            GET
                                                            /persons/{id}
                                                            Retrieve a person by ID
                                                        

                                                        

                                                            POST
                                                            /persons
                                                            Create a person (JSON format)
                                                        

                                                        

                                                            POST
                                                            /persons
                                                            Create a person (YAML format)
                                                        

                                                    
                                                

                                            

                                        

                                    

                                    

                                        

                                            
                                        

                                        

                                            

                                                
The Person API is vulnerable to deserialization attacks due to:

                                                
    
                                                    
  • Polymorphic type handling enabled in jackson-databind
    • 
                                                    
  • The modifiedAt field being of type Object
    • 
                                                    
  • Presence of the AnterosDBCPConfig gadget class in the classpath
    • 
                                                

                                                
Learn more about CVE-2020-9547.

                                            

                                        

                                    

                                

                            

                        

                    

                

            


            
            

                

                    

                        

                            

                                
File Upload

                            

                            

                                

                                    

                                        
                                        
                                    

                                    
                                

                                

                                    

                                

                                

                                    
Result:

                                    

                                

                            

                        

                    

                    

                        

                            

                                
Upload Instructions

                            

                            

                                
This demonstrates the file upload functionality that uses the vulnerable XZ library.

                                
Files uploaded will be stored in the uploads/ directory and then compressed with XZ compression.

                                

                                     Note: The application is using org.tukaani.xz version 1.9.2-malicious, which is intentionally vulnerable for demonstration purposes.
                                

                            

                        

                    

                

            


            
            

                

                    

                        

                            

                                
WebSocket Chat

                            

                            

                                

                                

                                    

                                        
                                        
                                    

                                

                            

                        

                    

                    

                        

                            

                                
Connection Status

                            

                            

                                

                                     Not Connected
                                

                                
                                
                            

                        

                        

                            

                                
WebSocket Info

                            

                            

                                
This chat uses the WebSocket endpoint at /chat-websocket.

                                
Messages sent here will be broadcast to all connected clients.

                                

                                     Note: This demonstrates Spring's WebSocket capabilities.