Notes on the JDK 7u21 Deserialization Vulnerability
0x01 Preface The construction of the native JDK 7u21 gadget chain is a classic. After studying its structure and underlying ideas, I wrote this article as a set of notes. 0x02 Prerequisites The JDK 7u21 chain uses many fundamental Java concepts, principally Java reflection, dynamic class modification with Javassist, Java static class loading, Java dynamic proxies, and hash collisions. To make the article easier to follow, I will…