Posted by evan via Fulldisclosure on Sep 26SUMMARY: an authenticated deserialization vuln in openEQUELLA allows an attacker to inject a SignedObject payload, unwrap the SignedObject, create an LDAP callback and serve a JNR response to get the server to execute arbitrary code. alongside this sink is a SSTI vuln as well. https://blog.evan.lat/posts/openeq/ openequella is an "open source digital repository" for educational material. it is widely used in australian universities...