XStream XML External Entity Vulnerability

XStream is a lightweight , easy to use open source Java class library developed by the XStream team , it is mainly used to serialize objects into XML JSON or deserialize objects. An XML external entity vulnerability exists in XStream version 1.4.9, which stems from the parser in the program...

Fedora 23 : jenkins-1.625.3-3.fc23 / jenkins-remoting-2.53.3-1.fc23 (2016-641c8b4eb2)

Fixes CVE-2016-0788, CVE-2016-0789, CVE-2016-0790, CVE-2016-0791, CVE-2016-0792, and possible NoClassDefFoundError: org/codehaus/stax2/XMLInputFactory2 exception bug. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenab...

openSUSE: Security Advisory for bsh2 (openSUSE-SU-2016:0788-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for bsh2 (important)

This update for bsh2 fixes the following issues: - CVE-2016-2510: An application that includes BeanShell on the classpath may be vulnerable if another part of the application uses Java serialization or XStream to deserialize data from an untrusted source. Please see...

Apache Groovy MethodClosure 远程代码执行漏洞（CVE-2015-3253）

问题大概出现在了 MethodClosure 类上, 该类定义以及方法如下图: 该类的描述为 Represents a method on an object using a closure which can be invoked at any time, 大概意思就是通过构建一个指定对象以及调用方法的Closure 的实例并且可以在任何时候进行调用。上图红色线标记的方法即为触发构建好的对象以及指定方法的函数，我们跟进看看该方法最终是怎么样执行的。 通过该方法的注释可以知道该方法的作用为调用指定对象的指定方法，所以 MethodClosure 类中构造方法中的两个参数的意思为 owne...

Xstream Deserializable Vulnerablity And Groovy（CVE-2 0 1 5-3 2 5 3-a vulnerability warning-the black bar safety net

The sequence of issues looks like in the recent outbreak of very frequently, recently there are friends asking me about this two-day outbreak of Xstream build deserialization vulnerabilities, the company recently very busy, but catch up on the weekend just take the time to see, in fact, this time...

XStream 反序列化漏洞

Xstream 的反序列化漏洞的根源就是 Groovy 组件的问题参考 Apache Groovy MethodClosure 远程代码执行漏洞（CVE-2015-3253），只不过在 Xstream 中进行反序列化时恰好有触发存在缺陷函数的点，也就是 Xstream 在反序列化时调用了 Mapput 函数将构造好的 Expando 实例作为 key 添加到集合中时触发了代码执行，如下图: 这里的 key 就是我们构造的 Expando 的实例对象。 在构造 EXP 时，首先我们要构造一个 Expando 的一个对象实例，同时设置 hashCode 的实现为 MethodClosure...

Debian DLA-443-1 : bsh security update

A remote code execution vulnerability was found in BeanShell, an embeddable Java source interpreter with object scripting language features. CVE-2016-2510: An application that includes BeanShell on the classpath may be vulnerable if another part of the application uses Java serialization or XStre...

Jenkins 低权限用户 API 服务调用 可致远程命令执行

漏洞演示 将 Jenkins 跑起来后，在低权限用户下构造 XML 文档： hashCode open /Applications/Calculator.app false 0 0 0 start 1 发送 Payload 至接口 http://...:8080/jenkins/createItem?name=knownsec： 成功后服务端会运行 计算器 程序。 漏洞影响 影响版本： 1.650 （1.650版本已修复该问题） 从zoomeye.org上搜索设备指纹“Jenkins” 从搜索的结果来看，约存在20000个潜在受到影响的目标。 相关链接...

FreeBSD : bsh -- remote code execution vulnerability (9e5bbffc-d8ac-11e5-b2bd-002590263bf5)

Stian Soiland-Reyes reports : This release fixes a remote code execution vulnerability that was identified in BeanShell by Alvaro Munoz and Christian Schneider. The BeanShell team would like to thank them for their help and contributions to this fix! An application that includes BeanShell on the...

CVE-2016-2510

BeanShell bsh before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler...

UBUNTU-CVE-2016-2510

BeanShell bsh before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler...

bsh -- remote code execution vulnerability

Stian Soiland-Reyes reports: This release fixes a remote code execution vulnerability that was identified in BeanShell by Alvaro Muñoz and Christian Schneider. The BeanShell team would like to thank them for their help and contributions to this fix! An application that includes BeanShell on the...

OpenMRS Reporting Module 0.9.7 - Remote Code Execution

Title: Unauthenticated remote code execution in OpenMRS Product: OpenMRS Vendor: OpenMRS Inc. Tested versions: See summary Status: Fixed by vendor Reported by: Brian D. Hysell Product description: OpenMRS is "the world's leading open source enterprise electronic medical record system platform."...

OpenMRS Reporting Module 0.9.7 - Remote Code Execution

OpenMRS Reporting Module 0.9.7 - Remote Code Execution Title: Unauthenticated remote code execution in OpenMRS Product: OpenMRS Vendor: OpenMRS Inc. Tested versions: See summary Status: Fixed by vendor Reported by: Brian D. Hysell Product description: OpenMRS is "the world's leading open source...

OpenMRS Reporting Module 0.9.7 - Remote Code Execution

Exploit for java platform in category web applications Title: Unauthenticated remote code execution in OpenMRS Product: OpenMRS Vendor: OpenMRS Inc. Tested versions: See summary Status: Fixed by vendor Reported by: Brian D. Hysell Product description: OpenMRS is "the world's leading open source...

OpenMRS Reporting Module 0.9.7 Remote Code Execution

Title: Unauthenticated remote code execution in OpenMRS Product: OpenMRS Vendor: OpenMRS Inc. Tested versions: See summary Status: Fixed by vendor Reported by: Brian D. Hysell Product description: OpenMRS is "the world's leading open source enterprise electronic medical record system platform."...

XStream: remote code execution due to insecure XML deserialization

It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream...

Important: Red Hat Security Advisory: Red Hat JBoss SOA Platform 5.3.1 security update

An update for Red Hat JBoss SOA Platform 5.3.1 which fixes multiple security issues is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

XStream: remote code execution due to insecure XML deserialization

It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream...