CVE-2020-26217
published 2020-11-16CVE-2020-26217: XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by…
PriorityP278high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
85.00%
99.7th percentile
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | < 5.15.14 | 5.15.14 |
| apache | activemq | — | — |
| atlassian | bamboo_data_center | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libxstream-java | < libxstream-java 1.4.14-1 (bookworm) | libxstream-java 1.4.14-1 (bookworm) |
| oracle | banking_cash_management | — | — |
| oracle | banking_cash_management | — | — |
| oracle | banking_cash_management | — | — |
| oracle | banking_corporate_lending_process_management | — | — |
| oracle | banking_corporate_lending_process_management | — | — |
| oracle | banking_corporate_lending_process_management | — | — |
| oracle | banking_credit_facilities_process_management | — | — |
| oracle | banking_credit_facilities_process_management | — | — |
| oracle | banking_credit_facilities_process_management | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_supply_chain_finance | — | — |
| oracle | banking_supply_chain_finance | — | — |
| oracle | banking_supply_chain_finance | — | — |
| oracle | banking_trade_finance_process_management | — | — |
| oracle | banking_trade_finance_process_management | — | — |
| oracle | banking_trade_finance_process_management | — | — |
| oracle | banking_virtual_account_management | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandcurl http://{{interactsh-url}}
processjava.lang.ProcessBuilder
- →Exploit payload uses XML deserialization to invoke java.lang.ProcessBuilder via XStream; look for 'ProcessBuilder' and 'start' tokens in deserialized XML input streams.
- →Proof-of-concept exploit triggers an outbound HTTP request with 'User-Agent: curl' as a callback; monitor for unexpected outbound curl-based HTTP requests from JVM processes.
- →Only deployments relying on XStream blocklists (denylist) are affected; allowlist-based Security Framework configurations are not vulnerable. ↗
- →The exploit abuses insecure XML deserialization; monitor for XML payloads referencing 'javax.imageio.ImageIO$ContainsFilter', 'java.beans.EventHandler', 'java.lang.ProcessBuilder', or 'java.lang.Void' class types in input streams. ↗
- ·OpenShift Container Platform jenkins packages are NOT affected due to JEP-200 and SECURITY-383 mitigations already in place. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_oracle8.8HIGH
vendor_redhat8.8HIGH
vendor_debian8.0HIGH
vendor_ubuntu8.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
libxstream-java vulnerabilities
osv·2024-08-22·CVSS 7.5
CVE-2016-3674 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
It was discovered that XStream incorrectly handled parsing of certain
crafted XML documents. A remote attacker could possibly use this issue to
read arbitrary files. (CVE-2016-3674)
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery
attacks. A remote attacker could request data from internal resources
that are not publicly available only by manipulating the processed input
stream. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion
on the local host. A remote attacker could use this to delete arbitrary
kn
OSV
libxstream-java vulnerabilities
osv·2021-05-11·CVSS 8.8
CVE-2020-26217 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. This issue affected only affected
Ubuntu 20.10. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream. This
issue only affected Ubuntu 20.10. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulatin
OSV
libxstream-java vulnerabilities
osv·2021-01-28·CVSS 8.8
CVE-2020-26217 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream.
(CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulating the processed input stream. (CVE-2020-26259)
OSV
XStream can be used for Remote Code Execution
osv·2020-11-16·CVSS 9.8
CVE-2020-26217 [CRITICAL] XStream can be used for Remote Code Execution
XStream can be used for Remote Code Execution
### Impact
The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.14.
### Workarounds
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.
Users of XStream 1.4.13 or below who still want to use XStream default blacklist can use a workaround depending on their version in use.
Users of XStream 1.4.13 can simpl
GHSA
XStream can be used for Remote Code Execution
ghsa·2020-11-16·CVSS 9.8
CVE-2020-26217 [CRITICAL] CWE-78 XStream can be used for Remote Code Execution
XStream can be used for Remote Code Execution
### Impact
The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.14.
### Workarounds
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.
Users of XStream 1.4.13 or below who still want to use XStream default blacklist can use a workaround depending on their version in use.
Users of XStream 1.4.13 can simpl
OSV
CVE-2020-26217: XStream before version 1
osv·2020-11-16·CVSS 8.8
CVE-2020-26217 [HIGH] CVE-2020-26217: XStream before version 1
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2024-08-22·CVSS 7.5
CVE-2021-21342 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream.
It was discovered that XStream incorrectly handled parsing of certain
crafted XML documents. A remote attacker could possibly use this issue to
read arbitrary files. (CVE-2016-3674)
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery
attacks. A remote attacker could request data from internal resources
that are not publicly available only by manipulating the processed input
stream. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion
on the local host.
Atlassian
CVE-2020-26217: RCE (Remote Code Execution) org.jvnet.hudson:xstream Dependency in Bamboo Data Center and Server
vendor_atlassian·2024-01-16·CVSS 8.8
CVE-2020-26217 [HIGH] CVE-2020-26217: RCE (Remote Code Execution) org.jvnet.hudson:xstream Dependency in Bamboo Data Center and Server
CVE-2020-26217: RCE (Remote Code Execution) org.jvnet.hudson:xstream Dependency in Bamboo Data Center and Server
RCE (Remote Code Execution) org.jvnet.hudson:xstream Dependency in Bamboo Data Center and Server
CVE: CVE-2020-26217
Severity: HIGH
Affected products: Bamboo Data Center
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2021-05-11·CVSS 8.0
CVE-2020-26258 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream library.
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. This issue affected only affected
Ubuntu 20.10. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream. This
issue only affected Ubuntu 20.10. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Collections (XStream) — CVE-2020-26217
vendor_oracle·2021-04-15·CVSS 8.8
CVE-2020-26217 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: Collections (XStream) — CVE-2020-26217
Oracle Oracle Financial Services Applications Risk Matrix: Collections (XStream) vulnerability
CVE: CVE-2020-26217
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2021 (APR 2021)
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2021-01-28·CVSS 8.0
CVE-2020-26217 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in libxstream-java.
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream.
(CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulating the processed input s
Red Hat
XStream: remote code execution due to insecure XML deserialization when relying on blocklists
vendor_redhat·2020-11-16·CVSS 8.8
CVE-2020-26217 [HIGH] CWE-502 XStream: remote code execution due to insecure XML deserialization when relying on blocklists
XStream: remote code execution due to insecure XML deserialization when relying on blocklists
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the
Debian
CVE-2020-26217: libxstream-java - XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnera...
vendor_debian·2020·CVSS 8.0
CVE-2020-26217 [HIGH] CVE-2020-26217: libxstream-java - XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnera...
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Scope: local
bookworm: resolved (fixed in 1.4.14-1)
bullseye: resolved (fixed in 1.4.14-1)
forky: resolved (fixed in 1.4.14-1)
sid: resolved (fixed in 1.4.14-1)
trixie: resolved (fixed in 1.4.14-1)
No detection rules found.
Nuclei
XStream <1.4.14 - Remote Code Execution
nuclei·CVSS 8.8
CVE-2020-26217 [HIGH] XStream <1.4.14 - Remote Code Execution
XStream
0
text/plain
0
-1
1
curl
http://{{interactsh-url}}
java.lang.ProcessBuilder
start
start
KEYS
0
0
0
false
0
test
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: curl"
# digest: 4a0a00473045022100d01e6cdad7b88c9f27f3892125d49c9459cc7af919bab1bac7a9ffd0a58e89c5022068749d4a4a072e756cd65549b7c9234ced6697dc02e770f94896847d7040489c:922c64590222798bb761d5b6d8e72950
arXiv
How well does LLM generate security tests?
arxiv_fulltext·2023-10-03
How well does LLM generate security tests?
How well does LLM generate security tests?
## Abstract
Developers often build software on top of third-party libraries (Libs) to improve programmer productivity and software quality. The libraries may contain vulnerabilities exploitable by hackers to attack the applications (Apps) built on top of them. People refer to such attacks as supply chain attacks, the documented number of which has increased 742% in 2022. People created tools to mitigate such attacks, by scanning the library dependencies of Apps, identifying the usage of vulnerable library versions, and suggesting secure alternatives to vulnerable dependencies. However, recent studies show that many developers do not trust the reports by these tools; they ask for code or evidence to demonstrate how library vulnerabilities lead to
Bugzilla
CVE-2020-26217 XStream: remote code execution due to insecure XML deserialization when relying on blocklists
bugzilla·2020-11-18·CVSS 8.8
CVE-2020-26217 [HIGH] CVE-2020-26217 XStream: remote code execution due to insecure XML deserialization when relying on blocklists
CVE-2020-26217 XStream: remote code execution due to insecure XML deserialization when relying on blocklists
It was found that Remote code execution (RCE) is possible in XStream prior to 1.4.14 via unsafe deserialization of user supplied XML in conjunction with relying on the default XStream deny list, a remote attacker could use this flaw to perform a variety of attacks but principally this is arbitrary code execution in the context of the JVM running the XStream application.
Upstream Advisory:
https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2
Upstream Fix:
https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a
Upstream explanation and PoC:
https://x-stream.github.io/CVE-2020-26217.html
Discussion:
Created xstream tracking bugs
https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1ahttps://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3Ehttps://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/12/msg00001.htmlhttps://security.netapp.com/advisory/ntap-20210409-0004/https://www.debian.org/security/2020/dsa-4811https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://x-stream.github.io/CVE-2020-26217.htmlhttps://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1ahttps://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3Ehttps://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/12/msg00001.htmlhttps://security.netapp.com/advisory/ntap-20210409-0004/https://www.debian.org/security/2020/dsa-4811https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://x-stream.github.io/CVE-2020-26217.html
2020-11-16
Published