PT-2021-4787 · Xstream+7 · Xstream+7
Published
2021-03-12
·
Updated
2024-08-22
·
CVE-2021-21350
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
XStream versions prior to 1.4.16
Description
The issue concerns a Java library used to serialize objects to XML and back again. It may allow a remote attacker to execute arbitrary code by manipulating the processed input stream. Users who set up the security framework with a whitelist limited to the minimal required types are not affected. The vulnerability is related to unlimited loading of dangerous file types.
Recommendations
To resolve the issue, use at least version 1.4.16 if you rely on XStream's default blacklist of the Security Framework. As a temporary workaround, consider setting up XStream's security framework with a whitelist limited to the minimal required types until a patch is available. Restrict access to the vulnerable
XStream library to minimize the risk of exploitation. Avoid using the default blacklist of the Security Framework until the issue is resolved.Exploit
Fix
Unrestricted File Upload
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Centos
Linuxmint
Red Hat
Suse
Ubuntu
Xstream