Remote Command Execution Vulnerability in libxstream-java: CVE-2021-39144
Summary
CVE-2021-39144: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java across 2 version ranges.
< 1.4.15-3+deb11u1
< b9ad1c02724c2b1636a8794c8e1bcd630f46c0b3
Fixed in 1.4.15-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
XStream is a popular open-source library used for serializing Java objects to XML and deserializing XML back to Java objects. It is widely utilized in various applications for its simplicity and efficiency in handling XML data. However, certain versions of XStream are vulnerable to a remote command execution issue, which can be exploited if the security framework is not properly configured.
Vulnerability Detail
CVE-2021-39144 is a vulnerability in XStream that allows a remote attacker with sufficient rights to execute arbitrary commands on the host system by manipulating the input stream processed by the library. This vulnerability arises from the library's default configuration, which does not implement a secure whitelist for object types, making it susceptible to exploitation. If an application using XStream does not restrict the types of objects that can be deserialized, an attacker could potentially gain control over the application and execute harmful commands.
How To Fix
Minimum fixed version
1.4.15-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to implement a security framework in XStream that restricts the types of objects that can be deserialized. This can be done by setting up a whitelist of allowed classes. Here is an example of how to configure the whitelist:
XStream xstream = new XStream();
// Allow only specific classes
xstream.allowTypeHierarchy(MyAllowedClass.class);
// Add more allowed classes as needed
xstream.allowTypeHierarchy(AnotherAllowedClass.class);
Conclusion
CVE-2021-39144 presents a significant risk to applications using the XStream library if not properly mitigated. Upgrading to a secure version and implementing a whitelist for deserialization are critical steps to protect against potential exploitation. Utilizing tools like Vulert can help monitor vulnerabilities in real-time.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-39144 is a vulnerability in the XStream library that allows remote command execution due to improper input stream handling.
Affected versions include those prior to 1.4.15-3+deb11u1 for Debian 11 and prior to 1.4.18-1 for Debian 12 and 13.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by simply using a manifest file like package-lock.json.
The CVSS score for CVE-2021-39144 is 8.5, indicating a high severity level.
If you cannot upgrade, implement a security framework in XStream to restrict deserialization to a whitelist of allowed classes as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
