XStream is vulnerable to an Arbitrary Code Execution attack

Vulnerability

XStream versions up to and including 1.4.17 are vulnerable to an arbitrary code execution attack when processing XML streams [1][2]. The bug resides in the unmarshalling logic, which reconstructs objects based on type information embedded in the input. An attacker can craft a malicious XML payload containing type references and serialized objects that trigger deserialization of attacker-controlled bytecode. The vulnerability is reachable when the application has not configured XStream's security framework with a whitelist of permitted types; the default setup in affected versions uses a blacklist approach, which is insufficient for securing general-purpose deserialization [1][2].

Exploitation

An attacker needs only to submit a crafted XML input to an application that uses XStream to deserialize data. No authentication, special network position, or prior user interaction is required. The exploit payload, provided in the advisory, consists of a LinkedHashSet containing a dynamic proxy with a CompositeInvocationHandlerImpl and a DTraceProbe that references a malicious TemplatesImpl object [2]. When the stream is unmarshalled, XStream creates these objects, triggering loading and execution of bytecodes (e.g., a Java class) from the remote attacker-controlled server [2].

Impact

Successful exploitation results in remote code execution (RCE) with the privileges of the application process. The attacker can load and execute arbitrary code from a remote host, leading to full compromise of confidentiality, integrity, and availability of the affected system [1][2].

Mitigation

Users must upgrade to XStream version 1.4.18, which changes the default security configuration to a whitelist model, blocking the vulnerability [1][2]. Alternatively, administrators can apply the security framework's whitelist recommendation to limit permitted types, which also prevents the attack [2]. No workaround is needed for users already employing a strict whitelist. Fedora package updates were announced for affected distributions [3][4].