CVE-2021-29505

This repository contains a functional exploit PoC for CVE-2021-29505, leveraging XStream deserialization with a crafted XML payload to achieve remote code execution via a malicious RMI server. The PoC uses the CommonsCollections6 gadget chain and includes detailed reproduction steps.

This is a functional exploit PoC for CVE-2021-29505, demonstrating a deserialization vulnerability in XStream. The code constructs a malicious XML payload that, when deserialized, triggers a chain of gadgets leading to arbitrary code execution via RMI registry interaction.

This repository contains a functional exploit PoC for CVE-2021-29505, leveraging XStream deserialization to achieve remote code execution via a crafted XML payload. The payload uses a chain of Java classes to trigger JNDI injection, targeting RMI endpoints.