Server-Side Request Forgery Vulnerability in XStream Library (CVE-2020-26258)
Summary
CVE-2020-26258: XStream is a Java library to serialize objects to XML and back again. Affects libxstream-java across 3 version ranges.
< 1.4.15-1
< 68fb49c10e083dce829476778eec726fc90c8c38
< f04bbec461f2c2a6f1e2cf41770f42c64aae24a4
Fixed in 1.4.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
XStream is a popular Java library that facilitates the serialization of objects to XML and vice versa. It is widely used in various applications for its ability to convert complex Java objects into XML format, making it easier to transmit data. However, prior to version 1.4.15, XStream had a significant security flaw that could be exploited by attackers to access internal resources that should not be publicly available.
Vulnerability Detail
The vulnerability, identified as CVE-2020-26258, is a Server-Side Request Forgery (SSRF) issue that arises during the unmarshalling process of XStream. An attacker can manipulate the input stream to make requests to internal services, potentially exposing sensitive data. This vulnerability affects users who rely on XStream's default blacklist for security, as it allows unauthorized access to internal resources. The issue does not exist for users running Java 15 or higher, nor for those who have implemented a whitelist in XStream's Security Framework.
How To Fix
Minimum fixed version
1.4.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, users can implement a workaround by configuring XStream's Security Framework to use a whitelist of allowed types instead of relying on the default blacklist. This can be done by adding the following code snippet:
XStream xstream = new XStream();
// Configure the whitelist
xstream.allowTypeHierarchy(SomeAllowedClass.class);
// Add other allowed classes as needed.
Conclusion
CVE-2020-26258 is a critical vulnerability in the XStream library that can lead to unauthorized access to internal resources. Users are strongly advised to upgrade to version 1.4.15 or higher to mitigate this risk. Implementing a whitelist can serve as an effective workaround for those unable to upgrade immediately.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2020-26258 is a vulnerability in the XStream library that allows attackers to perform Server-Side Request Forgery (SSRF) by manipulating input streams during unmarshalling.
Users of XStream versions prior to 1.4.15 who rely on the default blacklist for security are affected. Users running Java 15 or higher or those who have implemented a whitelist are not affected.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without any installation.
The CVSS score for CVE-2020-26258 is 7.7, indicating a high severity level.
If immediate upgrading is not possible, implement a workaround by configuring XStream's Security Framework to use a whitelist of allowed types.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
