Lab 169 — GridPulse — Insecure Deserialization via Configuration Import

hackadvisor

Task: Java/Spring Boot industrial monitoring platform with config import/export feature that base64-decodes user input and passes it to ObjectInputStream.readObject() without class filtering. Solution: craft CommonsCollections6 gadget chain with Runtime.exec(String[]) for bash -c command execution, exfiltrate /flag.txt via bash /dev/tcp to interaction server.