Author: Ahmed Attalla

KollectApps Insecure Java Deserialization (CVE-2021-27335)

KollectApp is a desktop application used heavily in the banking sector; it’s used to manage loan collection given to customers by the bank.While doing a penetration test on the application, I discovered critical insecure java deserialization that leads to remote code execution.During testing, I noticed the presence of java serialized payload at one of the application's requests. Since I decompiled the application jar files, I know that the commons collection gadget exists....