CVE-2021-29505

Reproduction Process

In IDEA, import the xstream component's jar package. This reproduction uses the CommonsCollections6 chain for exploitation, so import the commons-collections component jar package. POC is detailed in the attachment. First, use ysoserial to start a malicious RMI server for listening, and use the CommonsCollections6 chain for command execution, as shown below:

java -cp .\ysoserial.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections6  "calc"

At the same time, based on this vulnerability, the Xstrean deserialization process was analyzed and debugged, with records made; see xstream反序列化流程分析.pdf