Remote Code Execution Vulnerability in libxstream-java: CVE-2021-39153
Summary
CVE-2021-39153: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java across 2 version ranges.
< 1.4.15-3+deb11u1
< b9ad1c02724c2b1636a8794c8e1bcd630f46c0b3
Fixed in 1.4.15-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a popular open-source library used for serializing Java objects to XML and deserializing XML back to Java objects. It is widely utilized in various Java applications due to its simplicity and flexibility. However, certain versions of XStream are vulnerable to a critical security flaw that allows remote code execution if not properly configured.
Vulnerability Detail
CVE-2021-39153 is a vulnerability in XStream that allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. This vulnerability affects versions of XStream running with Java runtime versions 8 to 14, or with JavaFX installed. Users who do not implement XStream's security framework with a whitelist of minimal required types are at risk. The vulnerability has a CVSS score of 8.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.4.15-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement XStream's security framework by setting up a whitelist of allowed classes. This can be done by configuring the XStream instance as follows:
XStream xstream = new XStream();
xstream.allowTypeHierarchy(SomeAllowedClass.class);
This restricts the types that can be deserialized, reducing the risk of exploitation.
Conclusion
CVE-2021-39153 poses a significant risk to applications using vulnerable versions of the XStream library. It is crucial to update to the latest secure versions and configure the security framework to prevent potential exploitation. Regular monitoring with tools like Vulert can help maintain security against such vulnerabilities.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-39153 is a vulnerability in the XStream library that allows remote code execution through manipulated input streams.
Affected versions include those prior to 1.4.15-3+deb11u1 for Debian 11 and prior to 1.4.18-1 for Debian 12 and 13.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate upgrading is not possible, implement XStream's security framework with a whitelist of allowed types as a temporary measure.
The CVSS score of CVE-2021-39153 is 8.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
