XStream is vulnerable to a Remote Command Execution attack

Vulnerability

XStream is a Java library for serializing objects to XML. In versions prior to 1.4.16, the unmarshalling process uses type information from the input stream to recreate objects. An attacker can inject malicious type information, leading to the creation of objects that execute arbitrary commands on the host. [1][4]

Exploitation

The attack requires only the ability to supply a specially crafted XML (or JSON) input stream to XStream. The attacker does not need authentication if the application processes untrusted data. The manipulated stream can include objects like PriorityQueue with custom comparator chains that trigger command execution. [4]

Impact

Successful exploitation allows a remote attacker to execute arbitrary shell commands in the context of the server running XStream. This can lead to full system compromise, data exfiltration, or further lateral movement within the network. [3]

Mitigation

Users who have configured XStream's security framework with a whitelist of minimal required types are not affected. Those relying on the default blacklist must upgrade to XStream 1.4.16 or later. [2][1]