Log in Start free

Vulnerability · Published Dec 16, 2020 · Assigned by GitHub_M

CVE-2020-26258Server-Side Forgery Request can be activated unmarshalling with XStream

Medium 6.3

In plain English

A medium-severity server-side request forgery in xstream from x-stream. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 81.8% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)81.8%top 0.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC

Official description

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libxstream-java1.4.15-1DEBIAN-CVE-2020-26258
Debian:13libxstream-java1.4.15-1DEBIAN-CVE-2020-26258
Debian:14libxstream-java1.4.15-1DEBIAN-CVE-2020-26258
Mavencom.thoughtworks.xstream:xstream1.4.15GHSA-4cch-wxpw-8p28

Affected products (as reported)

VendorProductVersions
x-stream xstream < 1.4.15

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

References