XStream is vulnerable to an Arbitrary Code Execution attack

Vulnerability

XStream versions up to and including 1.4.17 are vulnerable to arbitrary code execution via insecure deserialization. The vulnerability occurs during unmarshalling when the input stream contains type information that XStream uses to create new instances. An attacker can manipulate the input to inject objects that lead to execution of arbitrary code loaded from a remote host [1][2]. Users who have configured a whitelist of minimal required types are not affected.

Exploitation

An attacker can craft a malicious XML payload, such as a PriorityQueue containing a dynamic proxy, and have it unmarshalled by XStream. The attack requires no authentication, only the ability to supply the malicious input to an application using XStream [2].

Impact

Successful exploitation enables remote code execution in the context of the application using XStream, potentially leading to full system compromise [1].

Mitigation

Upgrade to XStream 1.4.18, which disables the default blacklist and instead recommends using a whitelist of allowed types. Users who cannot upgrade should configure XStream's security framework with a whitelist limited to the minimal required types [1][2].