Critical Object Injection Vulnerability in libxstream-java: Risk of Local File Deletion
Summary
CVE-2021-21343: XStream is a Java library to serialize objects to XML and back again. Affects libxstream-java across 4 version ranges.
< 1.4.15-2
< 3dd9cc610199802e4f13bd49b02a9f99adaba145
< 7153c74dd0e860d0ca3825cc5a23e976e0242b6e
< a0d4141a00ba5de4afaee160836898b41eb28065
Fixed in 1.4.15-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is a Java library that facilitates the serialization and deserialization of objects to and from XML. It is widely used in various Java applications for its ease of use and flexibility in handling complex data structures. However, prior to version 1.4.16, libxstream-java is vulnerable to a critical security flaw that allows attackers to manipulate the input stream during the unmarshalling process, potentially leading to severe security breaches.
Vulnerability Detail
The vulnerability, identified as CVE-2021-21343, arises from the way XStream processes input streams during unmarshalling. The library uses type information from the processed stream to recreate objects, which can be exploited by an attacker. By injecting malicious data into the input stream, an attacker can replace or introduce objects that may lead to unauthorized actions, such as the deletion of files on the local host. This vulnerability affects users who do not implement XStream's security framework correctly, particularly those relying on the default blacklist settings.
How To Fix
Minimum fixed version
1.4.15-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to implement XStream's security framework with a strict whitelist of allowed types. This can be done by configuring the security settings in your application as follows:
XStream xstream = new XStream();
// Allow only specific classes
xstream.allowTypes(new Class[]{AllowedClass1.class, AllowedClass2.class});
Conclusion
CVE-2021-21343 represents a significant security risk for applications using libxstream-java prior to version 1.4.16. It is crucial for developers to upgrade to the latest version and implement proper security configurations to safeguard against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-21343 is a security vulnerability in the libxstream-java library that allows attackers to manipulate input streams, potentially leading to unauthorized file deletions.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software based on your manifest file. Visit Vulert Scanner for more information.
The CVSS score of CVE-2021-21343 is 7.5, indicating a high severity level.
If you cannot upgrade immediately, implement XStream's security framework with a strict whitelist of allowed types as a temporary workaround.
Failing to address this vulnerability may expose your application to attacks that can lead to unauthorized file access or deletion, compromising the integrity of your system.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
