Vulnerability in Xuxueli xxx-job Affects Deserialization Function
CVE-2024-3366
9.8CRITICAL
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2024-3366?
A template injection vulnerability exists in the Xuxueli XXL-Job component, specifically within the deserialize function in JdkSerializeTool.java. This issue allows attackers to manipulate input data, leading to possible code execution through injection techniques. The vulnerability, which affects versions up to 2.4.1, has been disclosed publicly and poses significant security risks if not addressed promptly.
Affected Version(s)
xxl-job 2.4.0
xxl-job 2.4.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.