Critical Remote Code Execution Vulnerability in libxstream-java
Summary
DEBIAN-CVE-2021-39149: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java versions < 1.4.15-3+deb11u1. Fixed in 1.4.15-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is a Java library that facilitates the serialization of objects to XML and vice versa. It is widely used for converting Java objects into XML format, making it easier to store and transmit data. However, certain versions of this library are vulnerable to a security flaw that could allow attackers to execute arbitrary code remotely by manipulating input streams.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2021-39149 allows remote attackers to load and execute arbitrary code from a remote host by exploiting the way libxstream-java processes input streams. This issue arises from the library's handling of object serialization, which can be manipulated if proper security measures are not implemented. Although users who configure XStream's security framework with a strict whitelist of types are not affected, those using default settings are at risk of exploitation.
How To Fix
Minimum fixed version
1.4.15-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can configure XStream's security framework to use a whitelist of allowed types, limiting the types that can be deserialized. This can be done by implementing the following code snippet in your Java application:
XStream xstream = new XStream();
// Allow only specific classes to be deserialized
xstream.allowTypes(new Class[]{YourAllowedClass.class});
Conclusion
The vulnerability in libxstream-java poses a significant risk of remote code execution if not addressed. Users are strongly encouraged to update to the latest patched versions and implement security best practices to safeguard their applications.
See every vulnerability recorded for libxstream-java →
FAQ
libxstream-java is a Java library used for serializing Java objects to XML and deserializing XML back to Java objects.
The vulnerability allows an attacker to execute arbitrary code on the server by manipulating the input stream processed by libxstream-java.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Update libxstream-java to the latest patched version as specified in the 'how to fix' section.
Yes, you can implement a security framework with a whitelist of allowed types to mitigate the risk temporarily.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
