Critical XXE Vulnerability in libxstream-java: Remote File Access Risk
Summary
UBUNTU-CVE-2016-3674: Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow... Affects libxstream-java versions < 1.4.7-1ubuntu0.1+esm2. Fixed in 1.4.7-1ubuntu0.1+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is a Java library that facilitates the serialization and deserialization of Java objects to and from XML. It is widely used in various applications for its ease of use and flexibility. However, it has been found to be vulnerable to multiple XML external entity (XXE) attacks, which can allow unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability arises from multiple XML external entity (XXE) vulnerabilities present in various drivers of the XStream library, including Dom4JDriver, DomDriver, JDomDriver, JDom2Driver, SjsxpDriver, StandardStaxDriver, and WstxDriver. These vulnerabilities allow remote attackers to craft malicious XML documents that can read arbitrary files from the server, potentially exposing sensitive information. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.4.7-1ubuntu0.1+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable XML external entity processing in your application. This can typically be done by configuring the XML parser to not resolve external entities. For example, in Java, you can set the following properties:
System.setProperty("javax.xml.XMLConstants/property/accessExternalSchema", "none");
System.setProperty("javax.xml.XMLConstants/property/accessExternalDTD", "none");
Conclusion
The XXE vulnerability in libxstream-java poses a significant risk to applications that utilize this library. It is crucial to update to the latest patched version to mitigate the risk of unauthorized file access. Additionally, implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for libxstream-java →
FAQ
An XXE (XML External Entity) vulnerability allows an attacker to interfere with the processing of XML data, potentially leading to the disclosure of sensitive information or server-side request forgery.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your manifest file, you can determine if your application is affected by this vulnerability.
If exploited, this vulnerability can lead to unauthorized access to sensitive files on the server, which could result in data breaches or further attacks.
Yes, you can disable XML external entity processing in your application as a temporary workaround until you can apply the patch.
More information can be found in the Ubuntu security notices and the official CVE documentation related to CVE-2016-3674.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
