Remote Code Execution Vulnerability in libxstream-java: CVE-2021-39154
Summary
CVE-2021-39154: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java across 2 version ranges.
< 1.4.15-3+deb11u1
< b9ad1c02724c2b1636a8794c8e1bcd630f46c0b3
Fixed in 1.4.15-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a widely used library in Java that facilitates the serialization of objects to XML and vice versa. It is favored for its simplicity and flexibility, allowing developers to easily convert Java objects into XML format for data exchange. However, its powerful features can also pose security risks if not properly configured, particularly in terms of input validation and type whitelisting.
Vulnerability Detail
CVE-2021-39154 is a critical vulnerability in XStream that allows remote attackers to execute arbitrary code by manipulating the input stream processed by the library. This vulnerability arises from the library's handling of untrusted input, which can lead to unauthorized code execution if the security framework is not configured correctly. Users who do not implement a strict whitelist of allowed types are particularly at risk, as the vulnerability can be exploited without any user interaction. The CVSS score for this vulnerability is 8.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.4.15-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to restrict the types that XStream can deserialize. This can be done by setting up a security framework with a strict whitelist of allowed types. Here’s an example of how to implement this in your code:
XStream xstream = new XStream();
// Set up security permissions
xstream.addPermission(NoTypePermission.NONE);
// Allow specific classes
xstream.allowType(MyAllowedClass.class);
// Add more allowed types as necessary.
Conclusion
CVE-2021-39154 is a significant vulnerability in the XStream library that can lead to remote code execution if not addressed. It is crucial for developers to upgrade to the latest versions of libxstream-java and configure the security framework properly to mitigate risks. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-39154 is a vulnerability in the XStream library that allows remote code execution through manipulated input streams.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software by analyzing the manifest file like package-lock.json.
The CVSS score for CVE-2021-39154 is 8.5, indicating a high severity level.
If you cannot upgrade immediately, implement a workaround by configuring XStream's security framework with a strict whitelist of allowed types.
More information can be found on the official CVE database or by using Vulert's playground to analyze your application.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
