29 lines
927 B
YAML
29 lines
927 B
YAML
cve: CVE-2017-9805
|
|
alias: Struts2 REST plugin XStream RCE
|
|
cwe_primary: CWE-502
|
|
cwe_acceptable: [CWE-502, CWE-915, CWE-913, CWE-94]
|
|
target_file: source.java
|
|
vuln_lines: [18, 19, 25, 30]
|
|
severity: critical
|
|
vuln_class: insecure_deserialization
|
|
exploit_pattern_regex: '<\s*(java\.lang\.ProcessBuilder|dynamic-proxy|java\.beans\.EventHandler)'
|
|
must_mention_any:
|
|
- deserialization
|
|
- deserialisation
|
|
- xstream
|
|
- allowlist
|
|
- whitelist
|
|
- gadget
|
|
- untrusted xml
|
|
- fromXML
|
|
- type filter
|
|
points: 30
|
|
notes: |
|
|
Vulnerability: XStream is instantiated without security framework / typePermissions,
|
|
so fromXML() will instantiate any class referenced in the XML. Attacker XML can
|
|
invoke the ProcessBuilder gadget chain for arbitrary RCE.
|
|
Hunter MUST identify:
|
|
1. No allowlist (XStream defaults to permissive)
|
|
2. Untrusted input is deserialised (fromXML on attacker reader)
|
|
3. Result is RCE via gadget chains
|