Critical XXE Vulnerabilities in libxstream-java: Remote File Access Risk
Summary
CVE-2016-3674: Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow... Affects libxstream-java across 2 version ranges.
< 1.4.9-1
< f66bbea1b383e705988abf8d06ea9782a73f24d4
Fixed in 1.4.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is a popular library used for serializing Java objects to XML and vice versa. It is widely utilized in various Java applications for data interchange. The library supports multiple drivers for XML parsing, making it versatile and efficient. However, prior to version 1.4.9, libxstream-java is susceptible to multiple XML External Entity (XXE) vulnerabilities, which can lead to unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerabilities stem from improper handling of XML input in several drivers, including Dom4JDriver, DomDriver, JDomDriver, JDom2Driver, SjsxpDriver, StandardStaxDriver, and WstxDriver. Attackers can exploit these vulnerabilities by crafting malicious XML documents that, when processed by the library, allow them to read arbitrary files on the server. This poses a significant security risk, as it could lead to exposure of sensitive data and further attacks on the system.
How To Fix
Minimum fixed version
1.4.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider disabling XML external entity processing in your application. This can often be done by configuring the XML parser to ignore external entities. For example, in Java, you can set the following properties when creating your XML parser:
System.setProperty('javax.xml.XMLConstants/property/accessExternalSchema', 'all');
System.setProperty('javax.xml.XMLConstants/property/accessExternalDTD', 'all');
However, this may limit some XML functionalities.
Conclusion
The XXE vulnerabilities in libxstream-java pose a significant risk to applications that utilize this library for XML processing. It is crucial to upgrade to version 1.4.9 or later to mitigate these risks. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for libxstream-java →
FAQ
XXE vulnerabilities occur when an XML parser processes external entities, allowing attackers to read files or make network requests from the server.
You can use tools like Vulert to check if your application is affected by this vulnerability by analyzing your manifest file.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files, data leakage, and potential further attacks on the system.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just a manifest file, ensuring you stay informed.
The CVSS score for this vulnerability is 7.5, indicating a high level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
