Remote Code Execution Vulnerability in libxstream-java: CVE-2021-21351
Summary
CVE-2021-21351: XStream is a Java library to serialize objects to XML and back again. Affects libxstream-java across 5 version ranges.
< 1.4.15-2
< 3dd9cc610199802e4f13bd49b02a9f99adaba145
< 54df0057e18d8c82c23fbd4e0bf5b5dc2e762955
< 7153c74dd0e860d0ca3825cc5a23e976e0242b6e
< a0d4141a00ba5de4afaee160836898b41eb28065
Fixed in 1.4.15-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a popular Java library that facilitates the serialization of objects to XML and vice versa. It is widely used for its simplicity and flexibility in handling Java objects. However, prior to version 1.4.16, XStream had a significant security vulnerability that could allow remote attackers to execute arbitrary code by manipulating the input stream, posing a serious risk to applications relying on this library.
Vulnerability Detail
CVE-2021-21351 is a critical vulnerability in XStream that allows remote code execution due to improper handling of input streams. Attackers can exploit this vulnerability by sending specially crafted XML data to an application using an affected version of XStream. If the security framework is not properly configured, this could lead to unauthorized access and execution of malicious code on the server, potentially compromising sensitive data and system integrity.
How To Fix
Minimum fixed version
1.4.15-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing a security framework with a strict whitelist of allowed types in XStream. This can be done by configuring the XStream instance as follows:
XStream xstream = new XStream();
// Allow only specific classes
xstream.allowTypeHierarchy(SomeAllowedClass.class);
This limits the types that can be deserialized, reducing the risk of exploitation.
Conclusion
CVE-2021-21351 represents a serious security risk for applications using the XStream library prior to version 1.4.16. It is crucial for developers to update their libraries and implement security best practices to protect against potential remote code execution attacks.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-21351 is a vulnerability in the XStream library that allows remote code execution through manipulated XML input.
Versions of libxstream-java prior to 1.4.16 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2021-21351 is 9.1, indicating a critical level of severity.
If you cannot upgrade immediately, implement a security framework with a strict whitelist of allowed types to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
