A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling

Vulnerability

XStream versions up to and including 1.4.17, when used with Java runtime versions 14 to 8, allow a Server-Side Request Forgery (SSRF) attack during XML unmarshalling. An attacker can inject or replace type information in the processed input stream to force XStream to make requests to arbitrary URLs, including internal or localhost resources [1][2]. Users who configured XStream's security framework with a whitelist are not affected [1][2].

Exploitation

An attacker needs only the ability to provide a crafted XML input stream to an application that unmarshals it using XStream. No authentication or special network position is required beyond sending the payload. The attacker creates a PriorityQueue marshalled to XML, then replaces the content with a malicious snippet that includes a dynamic proxy handler (e.g., com.sun.xml.internal.ws.client.sei.SEIStub) to trigger an HTTP request to an arbitrary URL [2].

Impact

Successful exploitation allows the attacker to perform server-side requests to internal or external resources accessible by the XStream application, potentially disclosing sensitive data from internal networks (e.g., cloud metadata endpoints, internal APIs) or the local host. This is primarily an information disclosure vulnerability with limited impact on integrity or availability [1][2].

Mitigation

XStream version 1.4.18 contains the fix for this vulnerability; users relying on the default blacklist security framework should upgrade to at least that version [1][2]. Administrators who follow the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types are not affected [1][2]. As of the publication date (2021-08-23), no other workarounds have been disclosed.