CVE-2016-3674: XML External Entity Injection in XStream

Background

XStream is a Java library that provides a simple way to serialize objects to XML and back again. It is widely used in various applications and frameworks for data serialization and deserialization. XStream supports multiple XML drivers, including Dom4JDriver, DomDriver, JDomDriver, JDom2Driver, SjsxpDriver, StandardStaxDriver, and WstxDriver. These drivers are responsible for parsing XML documents and converting them into Java objects. However, versions of XStream before 1.4.9 are vulnerable to XML external entity (XXE) injection attacks.

Vulnerability Detail

The vulnerability allows remote attackers to read arbitrary files by exploiting the XXE vulnerability in the XML parsing process. By crafting a malicious XML document, an attacker can include external entities that reference sensitive files on the server. When the XML document is processed by XStream, the parser resolves these entities and discloses the contents of the referenced files. This can lead to unauthorized access to sensitive information, such as configuration files, credentials, or other sensitive data stored on the server.

Workaround

If upgrading to the latest version of XStream is not immediately feasible, a temporary workaround is to disable external entity resolution manually. This can be done by configuring the XML parser used by XStream to disallow the processing of external entities. The specific steps to implement this workaround may vary depending on the XML parser being used. Here is an example of how to disable external entity resolution using the Woodstox XML parser:

1. Add the Woodstox dependency to your project:

<dependency>
  <groupId>com.fasterxml.woodstox</groupId>
  <artifactId>woodstox-core</artifactId>
  <version>6.2.4</version>
</dependency>

2. Configure XStream to use the Woodstox XML driver:

XStream xstream = new

XStream(new StaxDriver(new WstxInputFactory(), new WstxOutputFactory()));

3. Disable external entity resolution in the Woodstox XML driver:

((WstxDriver)

xstream.getDriver()).getConfiguredXMLInputFactory().setProperty(XMLInputFactory.SUPPORT_DTD, false);

((WstxDriver)

xstream.getDriver()).getConfiguredXMLInputFactory().setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);

By following these steps, you can mitigate the XXE vulnerability until a proper upgrade to the latest version of XStream can be performed.

Conclusion

The XML External Entity Injection vulnerability in XStream can have serious security implications, allowing attackers to read sensitive files on the server. It is crucial to upgrade to the latest version of XStream (1.4.9 or later) or apply the provided workaround to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for com.thoughtworks.xstream:xstream →

FAQ