Critical Remote Code Execution Vulnerability in libxstream-java
Summary
CVE-2021-21350: XStream is a Java library to serialize objects to XML and back again. Affects libxstream-java across 4 version ranges.
< 1.4.15-2
< 3dd9cc610199802e4f13bd49b02a9f99adaba145
< 7153c74dd0e860d0ca3825cc5a23e976e0242b6e
< a0d4141a00ba5de4afaee160836898b41eb28065
Fixed in 1.4.15-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is a Java library that facilitates the serialization of objects to XML and vice versa. It is widely used in various applications for data interchange and persistence. The library's functionality allows developers to easily convert Java objects into XML format, making it easier to store and transmit data. However, a significant vulnerability has been identified in versions prior to 1.4.16, which poses a risk of remote code execution if the library is not configured properly.
Vulnerability Detail
The vulnerability, identified as CVE-2021-21350, arises from improper handling of the processed input stream in XStream before version 1.4.16. A remote attacker can exploit this flaw to execute arbitrary code on the server by manipulating the input data. This vulnerability is particularly dangerous as it can lead to unauthorized access and control over the affected system. Users who do not implement XStream's security framework with a strict whitelist of allowed types are at risk, as relying on the default blacklist may not provide adequate protection.
How To Fix
Minimum fixed version
1.4.15-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to configure XStream's security framework to use a strict whitelist of allowed types. This involves explicitly defining which classes can be serialized and deserialized, thereby mitigating the risk of arbitrary code execution. Here is an example of how to set up a whitelist:
XStream xstream = new XStream();
// Allow only specific classes
xstream.allowTypes(new Class[]{MyClass.class, AnotherClass.class});
Conclusion
The CVE-2021-21350 vulnerability in libxstream-java poses a significant risk of remote code execution if not addressed. Users are strongly advised to upgrade to version 1.4.16 or later to mitigate this risk. Implementing a strict security framework can also provide a temporary safeguard against potential exploits.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-21350 is a critical vulnerability in the libxstream-java library that allows remote code execution due to improper input stream handling.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
If you cannot upgrade immediately, configure XStream's security framework to use a strict whitelist of allowed types as a temporary workaround.
More information about libxstream-java can be found on its official GitHub repository at https://github.com/x-stream/xstream.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
