Remote Code Execution Vulnerability in libxstream-java: CVE-2021-39151
Summary
CVE-2021-39151: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java across 2 version ranges.
< 1.4.15-3+deb11u1
< b9ad1c02724c2b1636a8794c8e1bcd630f46c0b3
Fixed in 1.4.15-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
XStream is a widely used library in Java that facilitates the serialization of objects to XML and vice versa. It is known for its simplicity and flexibility, allowing developers to easily convert Java objects into XML format for storage or transmission. However, due to its design, XStream can be vulnerable to security issues if not properly configured, particularly in terms of input validation and type whitelisting.
Vulnerability Detail
CVE-2021-39151 is a critical vulnerability in XStream that allows a remote attacker to exploit the library by manipulating the input stream. If an application using XStream does not implement the recommended security framework, an attacker could potentially load and execute arbitrary code from a remote host. This vulnerability arises from the library's handling of untrusted input, which can lead to severe security implications, including unauthorized access and data breaches. The CVSS score for this vulnerability is 8.5, indicating a high level of risk.
How To Fix
Minimum fixed version
1.4.15-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the types that XStream can deserialize by implementing a security framework that limits the input to a predefined set of classes. This can be done by using the following code snippet: XStream xstream = new XStream();
// Set up a whitelist of allowed classes
xstream.allowTypes(new Class[]{AllowedClass1.class, AllowedClass2.class});
This will help prevent the deserialization of untrusted input until you can apply the necessary updates.
Conclusion
CVE-2021-39151 is a significant vulnerability in the libxstream-java package that poses a risk of remote code execution. It is crucial for users to update their packages and configure security settings to protect against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-39151 is a vulnerability in the XStream library that allows remote code execution through manipulated input streams.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2021-39151 is 8.5, indicating a high severity level.
If an immediate update is not possible, implement a security framework with a whitelist of allowed types to mitigate the risk temporarily.
You can find more information about XStream and its features on its official GitHub repository at https://github.com/x-stream/xstream.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
