XStream is vulnerable to an Arbitrary Code Execution attack

Vulnerability

XStream versions up to and including 1.4.17 are affected by a deserialization vulnerability that allows an attacker to inject arbitrary objects during unmarshalling. By manipulating the processed input stream, the attacker can replace or inject type information that results in the execution of arbitrary code loaded from a remote server. Users who have set up XStream's security framework with a whitelist limited to the minimal required types are not affected. [1][2]

Exploitation

An attacker needs only to provide a crafted XML input to the XStream unmarshalling process. The steps involve creating a simple TreeSet, marshalling it to XML, and then replacing the XML with a malicious snippet that leverages the javax.naming.ldap.Rdn_-RdnEntry class and other gadgets to execute arbitrary code. The proof-of-concept exploit uses classes from com.sun.xml.internal.ws.api.message.Packet and com.sun.xml.internal.messaging.saaj.soap.ver1_1.Message1_1Impl. [2]

Impact

Successful exploitation allows a remote attacker to execute arbitrary code on the affected system. The attacker gains full control over the application's execution context, potentially leading to complete compromise of the confidentiality, integrity, and availability of the system. [1][2]

Mitigation

The vulnerability is fixed in XStream version 1.4.18, which no longer uses a blacklist by default. Users are strongly advised to upgrade to the latest version and to follow the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types. If upgrading is not immediately possible, users should implement a whitelist as a workaround. [1][2]