XStream is vulnerable to an Arbitrary Code Execution attack

Vulnerability

XStream is vulnerable to arbitrary code execution during unmarshalling. The processed input stream contains type information, and an attacker can inject objects that load and execute arbitrary code from a remote host. All versions up to and including 1.4.17 are affected if using the default configuration with JDK 1.7u21 or below, or when using an external Xalan regardless of Java runtime version. Users who have configured XStream's security framework with a whitelist are not affected [1][2][3].

Exploitation

An attacker needs to manipulate the input stream processed by XStream. The steps are: create a simple LinkedHashSet, marshal it to XML, replace the XML with a crafted payload (e.g., a TemplatesImpl object with malicious bytecodes), and unmarshal it again. No authentication or special access is required; the attacker only needs to supply the malicious XML to a vulnerable application [2].

Impact

Successful exploitation allows a remote attacker to load and execute arbitrary code from a remote host. This results in full system compromise, including arbitrary code execution with the privileges of the affected application. The vulnerability is classified as critical [1][2][3].

Mitigation

The vulnerability is fixed in XStream 1.4.18, which no longer uses a blacklist by default (as blacklisting cannot secure general-purpose use). Users should upgrade to version 1.4.18 or later. As a workaround, users can configure XStream's security framework with a whitelist limited to the minimal required types; this prevents the injection of unexpected classes [1][2][3].