cve: CVE-2017-9805
alias: Struts2 REST plugin XStream RCE
cwe_primary: CWE-502
cwe_acceptable: [CWE-502, CWE-915, CWE-913, CWE-94]
target_file: source.java
vuln_lines: [18, 19, 25, 30]
severity: critical
vuln_class: insecure_deserialization
exploit_pattern_regex: '<\s*(java\.lang\.ProcessBuilder|dynamic-proxy|java\.beans\.EventHandler)'
must_mention_any:
  - deserialization
  - deserialisation
  - xstream
  - allowlist
  - whitelist
  - gadget
  - untrusted xml
  - fromXML
  - type filter
points: 30
notes: |
  Vulnerability: XStream is instantiated without security framework / typePermissions,
  so fromXML() will instantiate any class referenced in the XML. Attacker XML can
  invoke the ProcessBuilder gadget chain for arbitrary RCE.
  Hunter MUST identify:
    1. No allowlist (XStream defaults to permissive)
    2. Untrusted input is deserialised (fromXML on attacker reader)
    3. Result is RCE via gadget chains