x-stream · xstream
The XStream Java serialization library, product xstream from vendor x-stream, contains an OS command injection flaw in versions before 1.4.14, where processing of crafted input can lead to arbitrary shell command execution. A remote attacker needs a deployment that relies on XStream's blocklist rather than its allowlist, and the exploit requires the attacker to get a victim to process the malicious input stream, with low privileges and some user interaction involved.
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Public exploit code (PoC-in-GitHub) appeared 22 days after disclosure. No confirmed exploitation is recorded.
A fix was bypassed or incomplete once over 8 years. The latest fix listed for xstream is 1.4.16.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: com.thoughtworks.xstream:xstream.
Upgrade to 1.4.18 or later
Fixes this CVE and 12 other known vulnerabilities in this package (CVE-2013-7285, CVE-2019-10173, +10).
Set the version to 1.4.18 or later in your pom.xml or build.gradle.
First fixed in 1.4.14-java7 for CVE-2020-26217.
| If you run | Upgrade to |
|---|---|
| All versions before 1.4.14-java7 | 1.4.18first fix for this CVE: 1.4.14-java7 |
“Up to” means the second version is the fix and is not affected.