catalogue . Java xStream . DynamicProxyConverter . java.beans.EventHandler . RCE via XStream object deserialization . Standard way to serialize and deserialize Objects with XStream . SECURITY- / CVE-- . What to do about it 0. 利用方式跟踪 目前为止,已知有两个触发方式 xs…
1.安装java jdk去oracle公司下载jdk-7u15-windows-i586.exehttp://www.oracle.com/technetwork/cn/java/javase/downloads/jdk7-downloads-1880260-zhs.html---C:\Documents and Settings\XXXX>java -versionjava version "1.7.0_15"Java(TM) SE Runtime Environment (b…