Remote Code Execution Vulnerability in libxstream-java: CVE-2021-39139
Summary
CVE-2021-39139: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java across 2 version ranges.
< 1.4.15-3+deb11u1
< b9ad1c02724c2b1636a8794c8e1bcd630f46c0b3
Fixed in 1.4.15-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a widely-used library that facilitates the serialization of Java objects to XML and vice versa. It is known for its simplicity and flexibility, allowing developers to easily convert complex data structures into a format suitable for storage or transmission. However, certain configurations of XStream, particularly when used with older versions of the Java Development Kit (JDK), can expose applications to serious security risks, including remote code execution.
Vulnerability Detail
CVE-2021-39139 is a critical vulnerability in XStream that enables remote attackers to execute arbitrary code by manipulating the input stream processed by the library. This issue primarily affects users running versions of XStream out of the box with JDK 1.7u21 or below. The vulnerability arises from the library's handling of XML input, which can be exploited if the security framework is not properly configured. Users who do not implement a security whitelist for the types being deserialized are particularly at risk. The severity of this vulnerability is underscored by its CVSS score of 8.8, indicating a high level of risk.
How To Fix
Minimum fixed version
1.4.15-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to restrict the types that can be deserialized by configuring XStream's security framework. This can be achieved by using a whitelist approach, as shown in the code snippet provided in the 'how_to_fix' section.
Conclusion
CVE-2021-39139 represents a significant security risk for applications using the XStream library, particularly those running outdated versions of the Java Development Kit. Users are strongly advised to upgrade to the latest versions of libxstream-java and to configure the security framework appropriately to mitigate potential exploits.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-39139 is a vulnerability in the XStream library that allows remote code execution through manipulated XML input.
Affected versions include those used with JDK 1.7u21 or below, particularly versions prior to 1.4.15-3+deb11u1 for Debian 11 and 1.4.18-1 for Debian 12 and 13.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, implement a security whitelist in XStream's configuration to limit deserialization to only necessary types.
The CVSS score for CVE-2021-39139 is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
