Critical Remote Command Execution Vulnerability in libxstream-java
Summary
CVE-2021-29505: XStream is software for serializing Java objects to XML and back again. Affects libxstream-java across 3 version ranges.
< 1.4.15-3
< 24fac82191292c6ae25f94508d28b9823f83624f
< f0c4a8d861b68ffc3119cfbbbd632deee624e227
Fixed in 1.4.15-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a popular library used for serializing Java objects to XML and deserializing XML back to Java objects. It simplifies the process of converting complex data structures into a format that can be easily transmitted or stored. However, certain versions of XStream are vulnerable to a remote command execution flaw that can be exploited if the security framework is not properly configured.
Vulnerability Detail
The vulnerability identified as CVE-2021-29505 affects XStream versions prior to 1.4.17. It allows a remote attacker with sufficient rights to execute arbitrary commands on the host system by manipulating the input stream processed by XStream. This issue arises from improper handling of untrusted input, which can lead to severe security implications, including unauthorized access and control over the affected system. Users who have implemented XStream's security framework with a strict whitelist of allowed types are not affected by this vulnerability.
How To Fix
Minimum fixed version
1.4.15-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not possible, consider implementing a security framework using XStream's built-in features. Configure a whitelist of allowed classes to limit the types of objects that can be deserialized. This can be done by using the following code snippet:
XStream xstream = new XStream();
xstream.allowTypes(new Class[] { AllowedClass1.class, AllowedClass2.class });
Conclusion
CVE-2021-29505 is a critical vulnerability in XStream that can lead to remote command execution if not addressed. Users are strongly advised to upgrade to version 1.4.17 or later to protect their systems. Implementing a security framework with a whitelist can also provide an additional layer of security.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-29505 is a vulnerability in XStream that allows remote command execution through manipulated input streams in versions prior to 1.4.17.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2021-29505 is 8.8, indicating a high severity level.
If an upgrade is not feasible, implement a security framework with a strict whitelist of allowed types to mitigate the risk.
Yes, if you have configured XStream's security framework with a proper whitelist, your system is not affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
