# VULNERABILITY REPORT: RCE via Insecure Deserialization ## EXECUTIVE SUMMARY A critical Remote Code Execution (RCE) vulnerability was discovered in the vehicle telemetry API. This flaw allowed unauthenticated attackers to execute arbitrary system commands on the production servers, potentially leading to full fleet compromise. ## TECHNICAL DETAILS **Endpoint:** `POST /api/v1/telemetry/ingest` **Parameter:** `data` (serialized object) The application accepted serialized Java objects in the `data` parameter without proper validation. By crafting a malicious payload using the `CommonsCollections` gadget chain, it was possible to trigger the execution of system commands during the deserialization process. ### PoC Payload (Decoded) ```java rO0ABXNyABFqYXZhLnV0aWwuSGFzaFNldL... ``` ### Impact - Full server compromise (root access). - Access to sensitive user data and vehicle location history. - Potential to inject malicious commands into connected vehicles. ## REMEDIATION 1. Disable deserialization of untrusted data. 2. Implement strict type checking if deserialization is necessary. 3. Update the affected library to the latest patched version. ## TIMELINE - **2024-11-15**: Vulnerability discovered and reported. - **2024-11-16**: Triaged by security team (Severity: Critical). - **2024-11-18**: Patch deployed to production. - **2024-11-20**: Bounty awarded ($15,000).