Remote Code Execution Vulnerability in libxstream-java: CVE-2021-39145
Summary
CVE-2021-39145: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java across 2 version ranges.
< 1.4.15-3+deb11u1
< b9ad1c02724c2b1636a8794c8e1bcd630f46c0b3
Fixed in 1.4.15-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a popular library used for serializing objects to XML and deserializing XML back into objects. It is widely utilized in Java applications for its simplicity and flexibility. However, certain versions of XStream are vulnerable to a security flaw that allows remote attackers to execute arbitrary code by manipulating the input stream, especially if the security framework is not properly configured.
Vulnerability Detail
CVE-2021-39145 is a critical vulnerability in XStream that allows a remote attacker to load and execute arbitrary code from a remote host. This vulnerability arises from improper input stream handling in affected versions of the library. If an application using XStream does not implement the recommended security framework with a whitelist of allowed types, it becomes susceptible to exploitation. The CVSS score for this vulnerability is 8.5, indicating a high severity level, which could lead to severe consequences for affected systems.
How To Fix
Minimum fixed version
1.4.15-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, implement a security framework in XStream that restricts the types that can be deserialized. This can be done by setting up a whitelist of allowed classes. For example, you can configure the XStream instance as follows:
XStream xstream = new XStream();
xstream.allowTypes(new Class[] { AllowedClass1.class, AllowedClass2.class });
Conclusion
CVE-2021-39145 is a significant vulnerability in the XStream library that can lead to remote code execution if not addressed. Users are strongly advised to upgrade to the latest versions and implement security best practices to safeguard their applications. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-39145 is a vulnerability in the XStream library that allows remote code execution through manipulated input streams.
Affected versions include those prior to 1.4.15-3+deb11u1 for Debian 11 and prior to 1.4.18-1 for Debian 12 and 13.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Implement a security framework in XStream that restricts deserialization to a whitelist of allowed types as a temporary workaround.
The CVSS score for CVE-2021-39145 is 8.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
