T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2017-9805/ground-truth.yaml

@@ -0,0 +1,28 @@
+cve: CVE-2017-9805
+alias: Struts2 REST plugin XStream RCE
+cwe_primary: CWE-502
+cwe_acceptable: [CWE-502, CWE-915, CWE-913, CWE-94]
+target_file: source.java
+vuln_lines: [18, 19, 25, 30]
+severity: critical
+vuln_class: insecure_deserialization
+exploit_pattern_regex: '<\s*(java\.lang\.ProcessBuilder|dynamic-proxy|java\.beans\.EventHandler)'
+must_mention_any:
+  - deserialization
+  - deserialisation
+  - xstream
+  - allowlist
+  - whitelist
+  - gadget
+  - untrusted xml
+  - fromXML
+  - type filter
+points: 30
+notes: |
+  Vulnerability: XStream is instantiated without security framework / typePermissions,
+  so fromXML() will instantiate any class referenced in the XML. Attacker XML can
+  invoke the ProcessBuilder gadget chain for arbitrary RCE.
+  Hunter MUST identify:
+    1. No allowlist (XStream defaults to permissive)
+    2. Untrusted input is deserialised (fromXML on attacker reader)
+    3. Result is RCE via gadget chains

bench/cve-hunt/samples/CVE-2017-9805/source.java

@@ -0,0 +1,32 @@
+// Struts2 REST plugin XStreamHandler.toObject() pre-CVE-2017-9805.
+// XStream deserialises XML from HTTP requests with NO type whitelist.
+
+package org.apache.struts2.rest.handler;
+
+import com.thoughtworks.xstream.XStream;
+import com.thoughtworks.xstream.io.xml.DomDriver;
+
+import java.io.InputStream;
+import java.io.Reader;
+
+public class XStreamHandler {
+
+    private final XStream xstream;
+
+    public XStreamHandler() {
+        // BUG: default XStream constructor permits *every* Java class to be
+        // instantiated from XML, including ProcessBuilder, dynamic proxies,
+        // and the entire XStream gadget chain.
+        this.xstream = new XStream(new DomDriver());
+    }
+
+    public Object toObject(Reader in, Class<?> clazz) {
+        // No allowlist/security framework configured.
+        // Attacker-controlled XML drives object graph instantiation.
+        return xstream.fromXML(in);
+    }
+
+    public Object toObject(InputStream in, Class<?> clazz) {
+        return xstream.fromXML(in);
+    }
+}