Remote Code Execution Vulnerability in XStream Library (CVE-2021-21344)
Summary
CVE-2021-21344: XStream is a Java library to serialize objects to XML and back again. Affects libxstream-java across 5 version ranges.
< 1.4.15-2
< 3dd9cc610199802e4f13bd49b02a9f99adaba145
< 54df0057e18d8c82c23fbd4e0bf5b5dc2e762955
< 7153c74dd0e860d0ca3825cc5a23e976e0242b6e
< a0d4141a00ba5de4afaee160836898b41eb28065
Fixed in 1.4.15-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a popular Java library that facilitates the serialization of objects to XML and vice versa. It is widely used in various applications for its ability to convert complex data structures into a format that can be easily transmitted and reconstructed. However, prior to version 1.4.16, XStream had a significant security flaw that could allow attackers to exploit the library's default settings, leading to potential remote code execution.
Vulnerability Detail
The vulnerability identified as CVE-2021-21344 arises from the way XStream processes input streams. An attacker can manipulate the input stream to load and execute arbitrary code from a remote host. This issue is particularly concerning for users who rely on XStream's default security settings, which may not adequately protect against such attacks. If users implement a security framework with a whitelist of allowed types, they can mitigate the risk. However, those who do not take these precautions are at risk of exploitation.
How To Fix
Minimum fixed version
1.4.15-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement XStream's security framework by configuring a whitelist of allowed types. This can be done by using the following code snippet:
XStream xstream = new XStream();
// Allow only specific classes
xstream.allowTypes(new Class[] { YourAllowedClass.class });
This approach limits the types that can be deserialized, reducing the risk of exploitation until an upgrade can be performed.
Conclusion
CVE-2021-21344 presents a serious risk to applications using the XStream library prior to version 1.4.16. Users are strongly advised to upgrade to the latest version or implement security measures to mitigate the risk of remote code execution. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-21344 is a vulnerability in the XStream library that allows remote code execution through manipulated input streams.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest file.
If an immediate upgrade is not possible, implement XStream's security framework with a whitelist of allowed types as a temporary workaround.
The CVSS score for CVE-2021-21344 is 9.8, indicating a critical level of severity.
More information can be found in the official CVE database and security advisories related to XStream.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
