XStream is vulnerable to an Arbitrary Code Execution attack

Vulnerability

In the affected XStream versions (all up to and including 1.4.17), the library unmarshals XML that contains type information to reconstruct serialized objects. An attacker can inject malicious type references into the input stream, causing XStream to load and instantiate classes from a remote server, leading to arbitrary code execution. The vulnerability does not affect users who have configured XStream's security framework with a whitelist of minimal required types [2].

Exploitation

The attacker needs only to provide a crafted XML input to a system that uses a vulnerable XStream configuration (i.e., no whitelist security framework). The exploit involves replacing the marshalled XML with a payload containing references to classes such as javax.naming.ldap.Rdn_-RdnEntry, javax.swing.MultiUIDefaults, and javax.swing.UIDefaults_-ProxyLazyValue that ultimately invoke javax.naming.InitialContext to load remote code. No authentication or prior access is necessary [2].

Impact

Successful exploitation allows a remote attacker to execute arbitrary code on the affected system, achieving full remote code execution (RCE). The attacker can run malicious code with the privileges of the XStream process, potentially leading to complete compromise of the application and server [1][2].

Mitigation

XStream 1.4.18 no longer uses a blacklist by default and users are strongly advised to upgrade to this version or later. For those unable to upgrade, the only known workaround is to properly configure the XStream security framework with a whitelist of permitted types. Distributions such as Fedora may provide updated packages [1][2][3][4].