CVE-2020-26258 PoC — XStream 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26258.yaml

Associated Vulnerability

Title:XStream 代码问题漏洞 (CVE-2020-26258)
Description:XStream是XStream（Xstream）团队的一个轻量级的、简单易用的开源Java类库，它主要用于将对象序列化成XML（JSON）或反序列化为对象。 XStream 存在代码问题漏洞，该漏洞源于服务器端伪造请求漏洞可以在解组时激活。该漏洞可能允许远程攻击者可利用该漏洞通过操纵已处理的输入流从内部资源请求不能公开使用的数据。

Description

XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.

File Snapshot


 id: CVE-2020-26258

info:
  name: XStream <1.4.15 - Server-Side Request Forgery
  author: pwnhxl
  s

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!