Remote Resource Access Vulnerability in libxstream-java - CVE-2021-21349
Summary
CVE-2021-21349: XStream is a Java library to serialize objects to XML and back again. Affects libxstream-java across 4 version ranges.
< 1.4.15-2
< 3dd9cc610199802e4f13bd49b02a9f99adaba145
< 7153c74dd0e860d0ca3825cc5a23e976e0242b6e
< a0d4141a00ba5de4afaee160836898b41eb28065
Fixed in 1.4.15-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libxstream-java is a Java library that facilitates the serialization of objects to XML and vice versa. It is widely used for converting Java objects into XML format, making it easier to store and transmit data. The library is known for its flexibility and ease of use, but it has a critical vulnerability that can expose internal resources to unauthorized access if not properly configured.
Vulnerability Detail
CVE-2021-21349 is a vulnerability in XStream, a Java library for XML serialization, that allows remote attackers to access internal resources by manipulating the input stream. This issue arises when the library's security framework is not configured with a strict whitelist of allowed types. If users rely on the default blacklist, they may inadvertently expose sensitive data, leading to potential data breaches or unauthorized access to internal systems. The vulnerability has a CVSS score of 8.6, indicating a high severity level.
How To Fix
Minimum fixed version
1.4.15-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can configure XStream's security framework to use a strict whitelist of allowed types. This can be done by modifying the code to include only the necessary classes for serialization, thereby limiting exposure to potential attacks. Example code snippet:
XStream xstream = new XStream();
// Allow only specific classes
xstream.allowTypes(new Class[]{MyClass.class, AnotherClass.class});
Conclusion
CVE-2021-21349 is a significant vulnerability in the libxstream-java library that can lead to unauthorized access to internal resources. It is crucial for users to upgrade to the latest version or implement strict security configurations to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-21349 is a vulnerability in the XStream library that allows remote attackers to access internal resources by manipulating the input stream.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The recommended version to fix this vulnerability is XStream version 1.4.16 or later.
If you cannot upgrade immediately, configure XStream's security framework to use a strict whitelist of allowed types as a temporary workaround.
The potential consequences include unauthorized access to sensitive internal resources, data breaches, and exposure of confidential information.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
