Description
5月14日，XStream官方发布安全更新，修复了一个严重漏洞CVE-2021-29505，通过该漏洞，攻击者构造特定的XML，绕过XStream的黑名单，最终触发反序列化造成任意代码执行。
XStream < 1.4.17 反序列化远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.aliyun.com/notice/113010
https://zhuanlan.zhihu.com/p/399502675
https://github.com/Kairo-one/CVE-2020-26217-XStream
https://nic.hibu.edu.cn/index.php?m=home&c=View&a=index&aid=116
https://www.secrss.com/articles/27117
https://rivers.chaitin.cn/blog/cq94feh0lnechd2437v0
https://blog.csdn.net/YouthBelief/article/details/121308616
https://www.h3c.com/cn/d_202112/1519555_30003_0.htm
https://www.modb.pro/db/120390
https://x-stream.github.io/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-29505
https://cloud.tencent.com/developer/article/1839233