Remote Code Execution on Apache Batik
Channel: Zero Day Initiative
Date: 2022-10-31

#Apache #ZeroDayInitiative #Exploit
This video demonstrates a remote code execution vulnerability exploited through remote JAR loading on Apache Batik. The security checks implemented in the default external resource controllers of Apache Batik could be bypassed prior to Batik 1.15 in order to perform SSRF through the JAR protocol or RCE through remote JAR loading.

For full details on the vulnerabilities, see the blog at:
https://www.zerodayinitiative.com/blog/2022/10/28/vulnerabilities-in-apache-batik-default-security-controls-ssrf-and-rce-through-remote-class-loading