AutoGenerateXalanPayload

Introduction

This is an automated payload generation tool for the JDK Xalan overflow vulnerability (CVE-2022-34169). It was created because different JDK versions require different overflow payloads. Running this tool with different JDK versions will generate different XSLT exploit files.

Usage

Copy select.bak.xslt to select.xslt and modify the command to be executed.

Then run java -jar AutoGenerateXalanPayload.jar. Some errors may be thrown during the process; ignore them. After execution, the generated select.xslt will be the Xalan overflow command execution payload for that JDK version.

Adaptation Approach

https://mp.weixin.qq.com/s/xxAtjFvk9RxWiY-pwGf8Ow

JDK Version Comparison

Due to the large number of JDK minor versions, I used a binary search method to compare versions from JDK 1.6 to JDK 1.8. Using JDK 1.7 as an example: first test the highest minor version of JDK 1.7 to obtain an XSLT, and define its content as type A. Then test the lowest minor version of JDK 1.7 to obtain another XSLT. If the two XSLTs are identical, it means all versions between the lowest and highest JDK 1.7 use the same type A payload. If they differ, I test the middle version of JDK 1.7 and continue the binary search. This is the fastest method I could think of – it avoids installing every single version while still covering all possibilities. For example, from the tested results below: Jdk-8u301 uses type A, Jdk-8u202 uses type A, so is it possible that Jdk-8u221 (the midpoint between them) uses type B? No.

Below are my test results, showing six different payload types between JDK 1.6 and JDK 1.8.

References

https://blog.noah.360.net/xalan-j-integer-truncation-reproduce-cve-2022-34169/