CVE-2020-26217

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Mitigation

Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list approach may not address.

Allow list approach

java  
XStream xstream = new XStream();  
XStream.setupDefaultSecurity(xstream);  
xstream.allowTypesByWildcard(new String[] {"com.misc.classname"})  

Deny list for XStream 1.4.13

java  
xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" });  
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });  

Deny list for XStream 1.4.7 -> 1.4.12

java  
xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" });  
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });  

Deny list for versions prior to XStream 1.4.7

java  
xstream.registerConverter(new Converter() {  
  public boolean canConvert(Class type) {  
    return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || Proxy.isProxy(type));  
  }  
  
  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {  
    throw new ConversionException("Unsupported type due to security reasons.");  
  }  
  
  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {  
    throw new ConversionException("Unsupported type due to security reasons.");  
  }  
}, XStream.PRIORITY_LOW);