Lead to RCE when unmarshal xml data with XStream #454
Description
The XstreamEngine unmarshal xml data based on XStream, but it doesn't check the data;
when the data contains malicious types, then it may leads to remote code execution;
The Struts2 framework once had the same issue(https://cwiki.apache.org/confluence/display/WW/S2-052);
Using the following code snippet to convert the malicious xml data:
POST("/xml", routeContext -> {
String xmlData = routeContext.getRequest().getBody();
XstreamEngine engine = new XstreamEngine();
engine.fromString(xmlData, String.class);
});The malicious xml data is as follows：
payload.txt
The tool marshalsec can help to generate more kinds of payload including the one above.
To mitigate the vulnerability, since version 1.4.7, XStream provides developers with some APIs (such as addPermission,denyPermission, allowTypes,denyTypes) to restrict the types be unmarshalled.
Here we could fix the issue refer to the patch of Struts2.