Critical Vulnerability in libxstream-java: Potential Server-Side Forgery Request
Summary
UBUNTU-CVE-2021-21342: XStream is a Java library to serialize objects to XML and back again. Affects libxstream-java versions < 1.4.7-1ubuntu0.1+esm2. Fixed in 1.4.7-1ubuntu0.1+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is a Java library that facilitates the serialization of objects to XML and their deserialization back to Java objects. It is widely used for converting Java objects into XML format, making it easier to transmit data over networks or store it in files. However, this library has a significant vulnerability that can be exploited if not properly secured, particularly in versions prior to 1.4.16.
Vulnerability Detail
The vulnerability in libxstream-java arises during the unmarshalling process, where the input stream contains type information necessary for recreating previously serialized objects. An attacker can manipulate this input stream to inject or replace objects, leading to potential server-side forgery requests. This vulnerability is particularly concerning for applications that do not implement XStream's security framework with a strict whitelist of allowed types. If the default blacklist is relied upon, the application remains at risk until updated to version 1.4.16 or later.
How To Fix
Minimum fixed version
1.4.7-1ubuntu0.1+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if updating the package is not immediately feasible, it is recommended to configure XStream's security framework to use a whitelist of allowed types, limiting the types that can be processed during unmarshalling. This can help mitigate the risk until an update can be applied.
Conclusion
The vulnerability in libxstream-java poses a significant risk to applications that utilize this library for XML serialization. It is crucial to update to a patched version or implement strict security measures to mitigate the risk of server-side forgery requests. Regular monitoring and vulnerability assessments are recommended to maintain application security.
See every vulnerability recorded for libxstream-java →
FAQ
The CVSS score for this vulnerability is 9.1, indicating a critical level of severity.
Versions of libxstream-java prior to 1.4.16 are affected by this vulnerability.
If left unaddressed, this vulnerability can allow attackers to perform server-side forgery requests, potentially compromising the integrity and security of your application.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert is a tool that monitors and alerts users in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
