XStream is vulnerable to an Arbitrary Code Execution attack

Vulnerability

XStream versions up to and including 1.4.17 are vulnerable to arbitrary code execution when unmarshalling XML input. The vulnerability exists because XStream uses type information in the serialized XML to recreate objects, and an attacker can inject malicious type references that cause the loading of arbitrary classes from a remote server. Users who have configured XStream's security framework with a whitelist of allowed types are not affected. [1][2]

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted XML stream to an application that unmarshals XStream data. The attacker does not need authentication or special privileges; only the ability to supply the input. The provided XML includes a manipulated PriorityQueue with entries that trigger the loading of remote classes via javax.naming.ldap.Rdn_-RdnEntry and com.sun.xml.internal.ws.api.message.Packet, ultimately leading to code execution. [2]

Impact

Successful exploitation allows a remote attacker to execute arbitrary code on the target system with the privileges of the application using XStream. This can lead to full compromise of the application and potentially the underlying server, including data theft, malware installation, or further lateral movement. [1][2]

Mitigation

The vulnerability is fixed in XStream version 1.4.18, which no longer uses a blacklist by default (as blacklists are insufficient for general purpose security). Users should upgrade to 1.4.18 or later. As a workaround, users can configure XStream's security framework with a whitelist of allowed types, which prevents the injection of arbitrary classes. [1][2]