Skip to content

Commit bb838ce

Browse files
joehnijoehni
committed
Document CVE-2024-47072 and add test case.
1 parent e42399f commit bb838ce

File tree

4 files changed

+99
-2
lines changed

4 files changed

+99
-2
lines changed

Diff for: ‎xstream-distribution/src/content/CVE-2024-47072.html

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
<html>
2+
<!--
3+
Copyright (C) 2024 XStream committers.
4+
All rights reserved.
5+
6+
The software in this package is published under the terms of the BSD
7+
style license a copy of which has been included with this distribution in
8+
the LICENSE.txt file.
9+
10+
Created on 19. September 2024 by Joerg Schaible
11+
-->
12+
<head>
13+
<title>CVE-2024-47072</title>
14+
</head>
15+
<body>
16+
17+
<h2 id="vulnerability">Vulnerability</h2>
18+
19+
<p>CVE-2024-47072: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated
20+
binary input stream.</p>
21+
22+
<h2 id="affected_versions">Affected Versions</h2>
23+
24+
<p>All versions until and including version 1.4.20 are affected, if using XStream's BinaryStreamDriver.</p>
25+
26+
<h2 id="description">Description</h2>
27+
28+
<p>XStream provides a BinaryStreamDriver with an own optimized serialization format. The format uses ids for
29+
string values as deduplication. The mapping for these ids are created on-the-fly at marshalling time. At
30+
unmarshalling time the reader's implementation simply used a simple one-time recursion after reading a mapping
31+
token to process the next normal token of the data stream. However, an endless recursion could be triggered with
32+
manipulated input data resulting in a stack overflow causing a denial of service.</p>
33+
34+
<h2 id="reproduction">Steps to Reproduce</h2>
35+
36+
<p>Prepare the manipulated data and provide it as input for a XStream instance using the BinaryDriver:</p>
37+
<div class="Source Java"><pre>final byte[] byteArray = new byte[36000];
38+
for (int i = 0; i &lt; byteArray.length / 4; i++) {
39+
byteArray[i * 4] = 10;
40+
byteArray[i * 4 + 1] = -127;
41+
byteArray[i * 4 + 2] = 0;
42+
byteArray[i * 4 + 3] = 0;
43+
}
44+
45+
XStream xstream = new XStream(new BinaryStreamDriver());
46+
xstream.fromXML(new ByteArrayInputStream(byteArray));
47+
</pre></div>
48+
49+
<p>As soon as the data gets unmarshalled, the endless recursion is entered and the executing thread is aborted with
50+
a stack overflow error.</p>
51+
52+
<h2 id="impact">Impact</h2>
53+
54+
<p>The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting
55+
in a denial of service only by manipulating the processed input stream if the instance is setup with a
56+
BinaryStreamDriver.</p>
57+
58+
<h2 id="workarounds">Workarounds</h2>
59+
60+
<p>A simple solution is to catch the StackOverflowError in the client code calling XStream. There's no other known
61+
workaround when using the BinaryStreamDriver.</p>
62+
63+
<h2 id="credits">Credits</h2>
64+
65+
<p>Alexis Challande of Trail Of Bits found and reported the issue to XStream and provided the required information to reproduce it.</p>
66+
67+
</body>
68+
</html>

Diff for: ‎xstream-distribution/src/content/security.html

+10-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<html>
22
<!--
3-
Copyright (C) 2014, 2015, 2017, 2019, 2020, 2021, 2022 XStream committers.
3+
Copyright (C) 2014, 2015, 2017, 2019, 2020, 2021, 2022, 2024 XStream committers.
44
All rights reserved.
55
66
The software in this package is published under the terms of the BSD
@@ -49,6 +49,15 @@ <h2 id="CVEs">Documented Vulnerabilities</h2>
4949
<th>CVE</th>
5050
<th>Description</th>
5151
</tr>
52+
<tr>
53+
<th>Version 1.4.21</th>
54+
<td></td>
55+
</tr>
56+
<tr>
57+
<th><a href="CVE-2024-47072.html">CVE-2024-47072</a></th>
58+
<td>XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input
59+
stream.</td>
60+
</tr>
5261
<tr>
5362
<th>Version 1.4.19</th>
5463
<td></td>

Diff for: ‎xstream-distribution/src/content/website.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<!--
22
Copyright (C) 2005, 2006 Joe Walnes.
3-
Copyright (C) 2006, 2007, 2010, 2011, 2014, 2015, 2016, 2017, 2020, 2021, 2022 XStream committers.
3+
Copyright (C) 2006, 2007, 2010, 2011, 2014, 2015, 2016, 2017, 2020, 2021, 2022, 2024 XStream committers.
44
All rights reserved.
55
66
The software in this package is published under the terms of the BSD
@@ -63,6 +63,7 @@
6363
</section>
6464
<section>
6565
<name>!Vulnerabilities</name>
66+
<page>CVE-2024-47072.html</page>
6667
<page>CVE-2022-41966.html</page>
6768
<page>CVE-2022-40151.html</page>
6869
<page>CVE-2021-21341.html</page>

Diff for: ‎xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java

+19
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,10 @@
2626
import java.util.Map;
2727
import java.util.Set;
2828

29+
import com.thoughtworks.xstream.XStream;
2930
import com.thoughtworks.xstream.converters.ConversionException;
3031
import com.thoughtworks.xstream.core.JVM;
32+
import com.thoughtworks.xstream.io.binary.BinaryStreamDriver;
3133
import com.thoughtworks.xstream.security.AnyTypePermission;
3234
import com.thoughtworks.xstream.security.ForbiddenClassException;
3335
import com.thoughtworks.xstream.security.InputManipulationException;
@@ -545,4 +547,21 @@ public void testStackOverflowWithDeeplyNestedStructure() {
545547
assertTrue(e.getMessage().indexOf("Stack Overflow") >= 0);
546548
}
547549
}
550+
551+
public void testStackOverflowInBinaryStreamReaderWithManipulatedInputData() {
552+
final byte[] byteArray = new byte[36000];
553+
for (int i = 0; i < byteArray.length / 4; i++) {
554+
byteArray[i * 4] = 10;
555+
byteArray[i * 4 + 1] = -127;
556+
byteArray[i * 4 + 2] = 0;
557+
byteArray[i * 4 + 3] = 0;
558+
}
559+
560+
try {
561+
xstream = new XStream(new BinaryStreamDriver());
562+
xstream.fromXML(new ByteArrayInputStream(byteArray));
563+
} catch (final InputManipulationException e) {
564+
assertTrue(e.getMessage().indexOf("two mapping tokens") >= 0);
565+
}
566+
}
548567
}

0 commit comments

Comments
 (0)