T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2017-9805/ground-truth.yaml

@@ -0,0 +1,28 @@
+cve: CVE-2017-9805
+alias: Struts2 REST plugin XStream RCE
+cwe_primary: CWE-502
+cwe_acceptable: [CWE-502, CWE-915, CWE-913, CWE-94]
+target_file: source.java
+vuln_lines: [18, 19, 25, 30]
+severity: critical
+vuln_class: insecure_deserialization
+exploit_pattern_regex: '<\s*(java\.lang\.ProcessBuilder|dynamic-proxy|java\.beans\.EventHandler)'
+must_mention_any:
+  - deserialization
+  - deserialisation
+  - xstream
+  - allowlist
+  - whitelist
+  - gadget
+  - untrusted xml
+  - fromXML
+  - type filter
+points: 30
+notes: |
+  Vulnerability: XStream is instantiated without security framework / typePermissions,
+  so fromXML() will instantiate any class referenced in the XML. Attacker XML can
+  invoke the ProcessBuilder gadget chain for arbitrary RCE.
+  Hunter MUST identify:
+    1. No allowlist (XStream defaults to permissive)
+    2. Untrusted input is deserialised (fromXML on attacker reader)
+    3. Result is RCE via gadget chains