Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

ClassNotFoundException from extension using Jersey

Adrian | Last updated: Mar 14, 2024 02:04PM UTC

Dear support, I have written an extension that is using behind the scene Jersey. Jersey is an open source framework for developing RESTful Web Services in Java. It provides support for JAX-RS APIs and serves as a JAX-RS Reference Implementation. Now, one of my extension REST entry points is returning a List of objects. This call is thowing a ClassNotFoundException. Usually this means that the class is not in the application classpath BUT in this case I'm positively sure that the specified class is in the classpath of the extension. I know that extensions have her own classloaders and my 50 cents is that Jersey framework (which tries to load the class that is not found) is somehow using another classloader which is not linked to the one of the extension. Any information about how Burp handles the classloaders would might be useful. thx, Adrian

Hannah, PortSwigger Agent | Last updated: Mar 15, 2024 10:32AM UTC

Hi Adrian Are you using a build manager like Gradle or Maven? Does your compiled extension JAR contain the Jersey library dependency?

Adrian | Last updated: Apr 19, 2024 02:44PM UTC

Hello, I have found the problem and the solution: So, the root cause of the ClassNotFoundException is that the classloader hierarchy of the threads serving the JAX-RS calls it does not include the (Burp Suite) extension classloader and so none of the classes from the (Burp Suite) extension classpath can be loaded by the JAX-RS calls. Just for the record, I explained the problem and the solution here (maybe it will help somebody else someday): https://adriancitu.com/2024/04/05/how-to-fix-classnotfoundexception-for-burp-suite-extension-using-jersey/

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.