Critical Remote Code Execution Vulnerability in libxstream-java
Summary
DEBIAN-CVE-2021-39153: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java versions < 1.4.15-3+deb11u1. Fixed in 1.4.15-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is a library designed for serializing Java objects to XML and deserializing XML back into Java objects. It is widely used for data interchange in Java applications due to its simplicity and flexibility. However, certain versions of this library are vulnerable to a critical security flaw that can be exploited by attackers to execute arbitrary code remotely.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2021-39153, allows a remote attacker to manipulate the input stream processed by libxstream-java, potentially leading to the execution of arbitrary code from a remote host. This issue arises when the library is used with Java runtime versions 8 to 14 or with JavaFX installed, without proper security configurations. Users who have not implemented XStream's security framework with a whitelist of required types are particularly at risk.
How To Fix
Minimum fixed version
1.4.15-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement XStream's security framework by setting up a whitelist that limits the types that can be deserialized. This can be done by configuring the XStream instance as follows:
XStream xstream = new XStream();
xstream.allowTypes(new Class[] { YourAllowedClass.class });
Conclusion
The libxstream-java library has a critical vulnerability that can lead to remote code execution if not addressed. Users are strongly advised to update to the latest patched versions to mitigate this risk. Implementing security best practices, such as using a whitelist for deserialization, can also help protect against potential exploits.
See every vulnerability recorded for libxstream-java →
FAQ
libxstream-java is a library that facilitates the serialization of Java objects to XML and vice versa, making it easier to exchange data between Java applications.
The vulnerability allows an attacker to execute arbitrary code on a victim's system by manipulating the input stream processed by the library.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement XStream's security framework to restrict deserialization to only trusted types as a temporary measure.
More details can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-39153.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
