CVE-2013-7285
published 2019-05-15CVE-2013-7285: Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell…
PriorityP183critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
84.36%
99.7th percentile
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | — | — |
| debian | libxstream-java | < libxstream-java 1.4.7-1 (bookworm) | libxstream-java 1.4.7-1 (bookworm) |
| debian | libxstream-java | < libxstream-java 1.4.11-1 (bookworm) | libxstream-java 1.4.11-1 (bookworm) |
| jenkins | jenkins_core | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | 2.4.0 – 2.10.0 | — |
| oracle | business_activity_monitoring | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | — | — |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | — | — |
| oracle | communications_diameter_signaling_router | 8.0.0 – 8.2.2 | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | endeca_information_discovery_studio | — | — |
| oracle | endeca_information_discovery_studio | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | utilities_framework | — | — |
| oracle | utilities_framework | — | — |
| oracle | utilities_framework | — | — |
| oracle | utilities_framework | — | — |
| oracle | utilities_framework | 4.3.0.1.0 – 4.3.0.6.0 | — |
| oracle | webcenter_portal | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/openmrs-standalone/module/reporting/definition/saveSerializedDefinition.form?type=org.openmrs.OpenmrsObject&serializationClass=org.openmrs.module.serialization.xstream.XStreamSerializer&serializedData=org.openmrs.OpenmrsObjectcalc.exestart&uuid=c1bf0730-e69e-11e3-ac10-0800200c9a66&name=test&subtype=org.openmrs.OpenmrsObject↗
- →Monitor for unauthenticated HTTP GET/POST requests to the OpenMRS endpoint `saveSerializedDefinition` with parameters `serializationClass` set to `org.openmrs.module.serialization.xstream.XStreamSerializer` and arbitrary `serializedData` content — this is the unauthenticated RCE vector. ↗
- →Alert on requests to `saveSerializedDefinition` containing the hardcoded UUID `c1bf0730-e69e-11e3-ac10-0800200c9a66`, which is the constant UUID inserted by the Appointment Scheduling UI module and required for successful exploitation. ↗
- →Detect XStream deserialization exploitation attempts by monitoring for XML/JSON payloads containing `java.lang.ProcessBuilder` or `java.beans.EventHandler` class references being passed to XStream unmarshalling endpoints. ↗
- →In Jenkins environments, monitor for low-privileged authenticated users triggering XML deserialization via the Jenkins XML API, which was the exploitation path for SECURITY-105 (CVE-2013-7285). ↗
- →Flag XStream deserialization payloads containing `javax.imageio.ImageIO$ContainsFilter`, `jdk.nashorn.internal.objects.NativeString`, or patterns matching `.*\$LazyIterator` or `javax\.crypto\..*` as these are known gadget types exploited via this vulnerability. ↗
- →The nuclei template for this CVE checks for an outbound HTTP callback with `User-Agent: curl` to an interactsh URL, indicating OOB (out-of-band) command execution via the XStream payload — monitor for unexpected outbound curl requests from Java application servers.
- ·The vulnerability only triggers if XStream's security framework has NOT been initialized. Deployments that have configured a whitelist or blacklist via XStream's Security Framework are not affected. ↗
- ·Affected XStream versions are up to 1.4.6 and version 1.4.10 specifically (1.4.10 was a regression). Versions 1.4.7–1.4.9 and 1.4.11+ are not affected. ↗
- ·For OpenMRS, unauthenticated exploitation requires BOTH the Reporting Module 0.9.7 AND the Appointment Scheduling UI Module 1.0.3 to be installed simultaneously. ↗
- ·A valid UUID for an existing definition must be supplied; exploitation fails with a NullPointerException otherwise. The hardcoded UUID from the Appointment Scheduling UI module satisfies this requirement. ↗
- ·Red Hat OpenShift Container Platform (3.11 and 4) Jenkins packages are NOT affected due to JEP-200 and SECURITY-383 mitigations already applied to the bundled XStream library. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
XStream: arbitrary file deletion on the local host when unmarshalling
vendor_redhat·2020-12-13·CVSS 8.8
CVE-2020-26259 [HIGH] CWE-78 XStream: arbitrary file deletion on the local host when unmarshalling
XStream: arbitrary file deletion on the local host when unmarshalling
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immedia
Red Hat
XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling
vendor_redhat·2020-12-13·CVSS 8.8
CVE-2020-26258 [HIGH] CWE-918 XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling
XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately sw
Debian
CVE-2019-10173: libxstream-java - It was found that xstream API version 1.4.10 before 1.4.11 introduced a regressi...
vendor_debian·2019·CVSS 9.8
CVE-2019-10173 [CRITICAL] CVE-2019-10173: libxstream-java - It was found that xstream API version 1.4.10 before 1.4.11 introduced a regressi...
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Scope: local
bookworm: resolved (fixed in 1.4.11-1)
bullseye: resolved (fixed in 1.4.11-1)
forky: resolved (fixed in 1.4.11-1)
sid: resolved (fixed in 1.4.11-1)
trixie: resolved (fixed in 1.4.11-1)
Red Hat
xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)
vendor_redhat·2018-10-23·CVSS 9.8
CVE-2019-10173 [CRITICAL] CWE-94 xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)
xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
It was found that xstream API version 1.4.10 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. This a regression of CVE-2013-7285 fixed in 1.4.7 (fixed) as of BPMS 6.0.1, the regression was introduced wi
Jenkins
Jenkins Security Advisory 2014-02-14
vendor_jenkins·2014-02-14·CVSS 4.3
CVE-2013-5573 [MEDIUM] Jenkins Security Advisory 2014-02-14
Title: Jenkins Security Advisory 2014-02-14
Jenkins Security Advisory 2014-02-14
This advisory announces multiple security vulnerabilities that were found in Jenkins core.
Description
SECURITY-105
In some places, Jenkins XML API uses XStream to deserialize arbitrary content, which is affected by CVE-2013-7285 reported against XStream. This allows malicious users of Jenkins with a limited set of permissions to execute arbitrary code inside the Jenkins controller.
SECURITY-76 & SECURITY-88 / CVE-2013-5573
Restrictions of HTML tags for user-editable contents are too lax. This allows malicious users of Jenkins to trick other unsuspecting users into providing sensitive information.
SECURITY-109
Plugging a hole in the earlier fix to SECURIT
Red Hat
XStream: remote code execution due to insecure XML deserialization
vendor_redhat·2013-12-22·CVSS 9.8
CVE-2013-7285 [CRITICAL] CWE-94 XStream: remote code execution due to insecure XML deserialization
XStream: remote code execution due to insecure XML deserialization
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.
Package: xstream (OpenShift Enterprise 1) - Will not fix
Package: xstream (Red Hat Enterprise Linux 7) - Not affected
Package: xstream (Red Hat JBoss SOA
Debian
CVE-2013-7285: libxstream-java - Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework h...
vendor_debian·2013·CVSS 9.8
CVE-2013-7285 [CRITICAL] CVE-2013-7285: libxstream-java - Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework h...
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Scope: local
bookworm: resolved (fixed in 1.4.7-1)
bullseye: resolved (fixed in 1.4.7-1)
forky: resolved (fixed in 1.4.7-1)
sid: resolved (fixed in 1.4.7-1)
trixie: resolved (fixed in 1.4.7-1)
OSV
XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
osv·2020-12-21
CVE-2020-26259 [MEDIUM] XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
### Impact
The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.15.
### Workarounds
The reported vulnerability does only exist with a JAX-WS runtime on the classpath.
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid th
GHSA
Server-Side Forgery Request can be activated unmarshalling with XStream
ghsa·2020-12-21
CVE-2020-26258 [MEDIUM] CWE-918 Server-Side Forgery Request can be activated unmarshalling with XStream
Server-Side Forgery Request can be activated unmarshalling with XStream
### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.15.
### Workarounds
The reported vulnerability does not exist running Java 15 or higher.
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.
Users of XStream 1.4.14 or below wh
GHSA
XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
ghsa·2020-12-21
CVE-2020-26259 [MEDIUM] CWE-78 XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
### Impact
The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.15.
### Workarounds
The reported vulnerability does only exist with a JAX-WS runtime on the classpath.
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid th
OSV
Server-Side Forgery Request can be activated unmarshalling with XStream
osv·2020-12-21
CVE-2020-26258 [MEDIUM] Server-Side Forgery Request can be activated unmarshalling with XStream
Server-Side Forgery Request can be activated unmarshalling with XStream
### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.15.
### Workarounds
The reported vulnerability does not exist running Java 15 or higher.
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.
Users of XStream 1.4.14 or below wh
OSV
XStream can be used for Remote Code Execution
osv·2020-11-16·CVSS 9.8
CVE-2020-26217 [CRITICAL] XStream can be used for Remote Code Execution
XStream can be used for Remote Code Execution
### Impact
The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.14.
### Workarounds
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.
Users of XStream 1.4.13 or below who still want to use XStream default blacklist can use a workaround depending on their version in use.
Users of XStream 1.4.13 can simpl
GHSA
XStream can be used for Remote Code Execution
ghsa·2020-11-16·CVSS 9.8
CVE-2020-26217 [CRITICAL] CWE-78 XStream can be used for Remote Code Execution
XStream can be used for Remote Code Execution
### Impact
The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.14.
### Workarounds
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.
Users of XStream 1.4.13 or below who still want to use XStream default blacklist can use a workaround depending on their version in use.
Users of XStream 1.4.13 can simpl
GHSA
Deserialization of Untrusted Data and Code Injection in xstream
ghsa·2019-07-26·CVSS 9.8
CVE-2019-10173 [CRITICAL] CWE-502 Deserialization of Untrusted Data and Code Injection in xstream
Deserialization of Untrusted Data and Code Injection in xstream
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
OSV
Deserialization of Untrusted Data and Code Injection in xstream
osv·2019-07-26·CVSS 9.8
CVE-2019-10173 [CRITICAL] Deserialization of Untrusted Data and Code Injection in xstream
Deserialization of Untrusted Data and Code Injection in xstream
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
OSV
CVE-2019-10173: It was found that xstream API version 1
osv·2019-07-23·CVSS 9.8
CVE-2019-10173 [CRITICAL] CVE-2019-10173: It was found that xstream API version 1
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
GHSA
Command Injection in Xstream
ghsa·2019-05-29
CVE-2013-7285 [CRITICAL] CWE-77 Command Injection in Xstream
Command Injection in Xstream
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
OSV
Command Injection in Xstream
osv·2019-05-29
CVE-2013-7285 [CRITICAL] Command Injection in Xstream
Command Injection in Xstream
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
OSV
CVE-2013-7285: Xstream API versions up to 1
osv·2019-05-15·CVSS 9.8
CVE-2013-7285 [CRITICAL] CVE-2013-7285: Xstream API versions up to 1
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
No detection rules found.
Exploit-DB
OpenMRS Reporting Module 0.9.7 - Remote Code Execution
exploitdb·2016-01-07·CVSS 9.8
CVE-2013-7285 [CRITICAL] OpenMRS Reporting Module 0.9.7 - Remote Code Execution
OpenMRS Reporting Module 0.9.7 - Remote Code Execution
---
Title: Unauthenticated remote code execution in OpenMRS
Product: OpenMRS
Vendor: OpenMRS Inc.
Tested versions: See summary
Status: Fixed by vendor
Reported by: Brian D. Hysell
Product description:
OpenMRS is "the world's leading open source enterprise electronic
medical record system platform."
Vulnerability summary:
The OpenMRS Reporting Module 0.9.7 passes untrusted XML input to a
version of the XStream library vulnerable to CVE-2013-7285, making it
vulnerable to remote code execution. If the Appointment Scheduling UI
Module 1.0.3 is also installed, this RCE is accessible to
unauthenticated attackers. OpenMRS Standalone 2.3 and OpenMRS Platform
1.11.4 WAR with Reporting 0.9.7 and Appointment Scheduling UI 1.0.3
installed we
Nuclei
XStream <1.4.6/1.4.10 - Remote Code Execution
nuclei·CVSS 9.8
CVE-2013-7285 [CRITICAL] XStream <1.4.6/1.4.10 - Remote Code Execution
XStream
foo
java.lang.Comparable
curl
http://{{interactsh-url}}
start
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: curl"
# digest: 4a0a00473045022100c807927e6793dad1b260a8fb24973cf6bec3076ca7974eb05d8944e5327298df022008eb67daa97b34c32e72ba42d8d39fbc56a91216ac760f358e073a508ce0ffc4:922c64590222798bb761d5b6d8e72950
Bugzilla
CVE-2020-26258 XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling
bugzilla·2020-12-17·CVSS 7.7
CVE-2020-26258 [HIGH] CVE-2020-26258 XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling
CVE-2020-26258 XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can
Bugzilla
CVE-2020-26259 XStream: arbitrary file deletion on the local host when unmarshalling
bugzilla·2020-12-17·CVSS 6.8
CVE-2020-26259 [MEDIUM] CVE-2020-26259 XStream: arbitrary file deletion on the local host when unmarshalling
CVE-2020-26259 XStream: arbitrary file deletion on the local host when unmarshalling
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blackl
Bugzilla
CVE-2019-10173 xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)
bugzilla·2019-06-21·CVSS 9.8
CVE-2019-10173 [CRITICAL] CVE-2019-10173 xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)
CVE-2019-10173 xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)
A vulnerability was found in xstream API version 1.4.10, if the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON. This a regression of CVE-2013-7285 fixed in 1.4.7 (fixed) as of BPMS 6.0.1, the regression was introduced with xstream-1.4.10 implemented in RHPAM.
References:
https://access.redhat.com/security/cve/cve-2013-7285
Discussion:
External References:
http://x-stream.github.io/changes.html#1.4.11
---
This issue has been addressed in the following products:
Red Hat Process Automation
Via RHSA-2019:1823 https:
Bugzilla
CVE-2013-7285 XStream: remote code execution due to insecure XML deserialization [fedora-all]
bugzilla·2014-02-11·CVSS 9.8
CVE-2013-7285 [CRITICAL] CVE-2013-7285 XStream: remote code execution due to insecure XML deserialization [fedora-all]
CVE-2013-7285 XStream: remote code execution due to insecure XML deserialization [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note
Bugzilla
CVE-2013-7285 XStream: remote code execution due to insecure XML deserialization
bugzilla·2014-01-10·CVSS 9.8
CVE-2013-7285 [CRITICAL] CVE-2013-7285 XStream: remote code execution due to insecure XML deserialization
CVE-2013-7285 XStream: remote code execution due to insecure XML deserialization
It was found that XStream would deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.
Discussion:
Upstream mailing list discussion:
http://markmail.org/message/kfqoqdfj5fnup5co?q=list:org.codehaus.xstream.dev
Upstream patch commit:
https://fisheye.codehaus.org/changelog/xstream?cs=2210
External References:
http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/
http:/
Recorded Future
The Race Between Security Professionals and Adversaries
blogs_recorded_future
The Race Between Security Professionals and Adversaries
# The Race Between Security Professionals and Adversaries
We examined vulnerabilities between first disclosure and release on the National Vulnerability Database (NVD) to understand timelines of the security community and threat actors.
### Key Takeaways
- 75% of vulnerabilities are disclosed prior to NVD release with a median of seven days prior notice. This median gap is increasing, complicating the ability of vulnerability management teams to stay current and, with increasing gaps, the situation is worsening.
- Over 1,500 sources reported over 114,000 times on vulnerabilities prior to release, including community intelligence and adversary intelligence sources on the deep and dark web.
- Higher severity vulnerabilities have shorter release lags as more effort is put into communicatin
http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlhttp://seclists.org/oss-sec/2014/q1/69http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlhttps://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3Ehttps://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.htmlhttps://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://x-stream.github.io/CVE-2013-7285.htmlhttp://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlhttp://seclists.org/oss-sec/2014/q1/69http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.htmlhttps://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3Ehttps://www.mail-archive.com/user%40xstream.codehaus.org/msg00604.htmlhttps://www.mail-archive.com/user%40xstream.codehaus.org/msg00607.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://x-stream.github.io/CVE-2013-7285.html
2019-05-15
Published