Critical Server-Side Forgery Vulnerability in libxstream-java (CVE-2021-21342)
Summary
CVE-2021-21342: XStream is a Java library to serialize objects to XML and back again. Affects libxstream-java across 4 version ranges.
< 1.4.15-2
< 3dd9cc610199802e4f13bd49b02a9f99adaba145
< 7153c74dd0e860d0ca3825cc5a23e976e0242b6e
< a0d4141a00ba5de4afaee160836898b41eb28065
Fixed in 1.4.15-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a widely used Java library that facilitates the serialization of objects to XML and vice versa. It is designed to simplify the process of converting complex Java objects into a format that can be easily stored or transmitted. However, the library has a known vulnerability that can be exploited if proper security measures are not implemented. This vulnerability allows attackers to manipulate the input stream during the unmarshalling process, potentially leading to unauthorized actions on the server.
Vulnerability Detail
In XStream versions prior to 1.4.16, there exists a vulnerability during the unmarshalling process where an attacker can inject or replace objects in the processed input stream. This manipulation can lead to server-side forgery requests, allowing the attacker to perform actions on behalf of the server without proper authorization. The vulnerability arises from the way XStream handles type information, which can be exploited if the security framework is not configured correctly. Users who do not implement a whitelist of allowed types are particularly at risk.
How To Fix
Minimum fixed version
1.4.15-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, a temporary workaround is to ensure that the security framework is configured to use a strict whitelist of allowed types. This can help mitigate the risk until a proper upgrade can be performed. Example of a strict whitelist configuration:
XStream xstream = new XStream();
// Define a strict whitelist
xstream.allowTypes(new Class[] {AllowedClass1.class, AllowedClass2.class});
Conclusion
CVE-2021-21342 represents a significant security risk for applications using the XStream library. It is essential for developers to upgrade to version 1.4.16 or later and to implement a strict security framework configuration to protect against potential exploitation. Regular monitoring for vulnerabilities using tools like Vulert can also help maintain application security.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-21342 is a critical vulnerability in the XStream library that allows attackers to manipulate the unmarshalling process, potentially leading to server-side forgery requests.
XStream versions prior to 1.4.16 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2021-21342 is 9.1, indicating a critical level of severity.
If an immediate upgrade is not possible, configure XStream's security framework to use a strict whitelist of allowed types as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
