cve/2019/CVE-2019-17570.md

### [CVE-2019-17570](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17570)
![](https://img.shields.io/static/v1?label=Product&message=Apache%20XML-RPC&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Deserialization&color=brighgreen)

### Description

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

### POC

#### Reference
- http://www.openwall.com/lists/oss-security/2020/01/24/2
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-x2r6-4m45-m4jp

#### Github
- https://github.com/0xT11/CVE-POC
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Live-Hack-CVE/CVE-2019-17570
- https://github.com/PalindromeLabs/Java-Deserialization-CVEs
- https://github.com/developer3000S/PoC-in-GitHub
- https://github.com/fbeasts/xmlrpc-common-deserialization
- https://github.com/hectorgie/PoC-in-GitHub
- https://github.com/omegat-org/apache-xmlrpc
- https://github.com/omegat-org/moses-plugin
- https://github.com/r00t4dm/CVE-2019-17570
- https://github.com/slowmistio/xmlrpc-common-deserialization