Exploitation Summary
EIP tracks 6 public exploits for CVE-2020-26259. PoCs published by jas502n, JAckLosingHeart, Al1ex.
AI-analyzed exploit summary This repository contains proof-of-concept exploits for CVE-2020-26259 (arbitrary file deletion) and CVE-2020-26258 (SSRF) in XStream versions up to 1.4.14. The exploits leverage deserialization vulnerabilities to trigger malicious behavior.
Description
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
Exploits (6)
This repository contains proof-of-concept exploits for CVE-2020-26259 (arbitrary file deletion) and CVE-2020-26258 (SSRF) in XStream versions up to 1.4.14. The exploits leverage deserialization vulnerabilities to trigger malicious behavior.
The repository contains a minimal Java code snippet that initializes XStream and deserializes an XML file, but lacks the actual exploit payload or technical details. It is incomplete and does not demonstrate the vulnerability.
This PoC demonstrates an arbitrary file deletion vulnerability in XStream versions <= 1.4.14 via crafted XML input during unmarshalling. The exploit leverages deserialization to trigger file deletion on the local host.
This repository contains benchmarking code for XStream but lacks any exploit code or technical analysis related to CVE-2020-26259. The files are part of a performance testing framework and do not demonstrate the vulnerability.
The repository contains benchmarking code for XStream but lacks any exploit code or technical analysis related to CVE-2020-26259. It appears to be a placeholder or incomplete repository.
This repository contains a minimal Java stub for CVE-2020-26259, an XStream deserialization vulnerability. The code initializes XStream and attempts to deserialize XML from a file, but lacks the exploit payload or detailed context.
References (9)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N