CVE-2020-26258
published 2020-12-16CVE-2020-26258: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be…
PriorityP276high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EXPLOIT
EPSS
82.24%
99.6th percentile
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | < 6.0.0 | 6.0.0 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libxstream-java | < libxstream-java 1.4.15-1 (bookworm) | libxstream-java 1.4.15-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| x-stream | xstream | < 1.4.15 | 1.4.15 |
| xstream | xstream | < 1.4.15 | 1.4.15 |
Detection & IOCsextracted from sources · hover to see the quote
- →Nuclei template detects SSRF exploitation by monitoring for outbound HTTP callbacks with a Java User-Agent, triggered by a crafted XStream XML payload containing an internal URL reference sent during unmarshalling.
- →The SSRF payload embeds an internal resource URL inside the XStream-serialized XML stream to trigger server-side forgery during unmarshalling.
- →Detect unmarshalling of the type `jdk.nashorn.internal.objects.NativeString` in XStream XML input as an indicator of exploitation attempt for this CVE. ↗
- →Detect unmarshalling of types matching `.*\.ReadAllStream\$FileStream` pattern in XStream XML input as an indicator of exploitation. ↗
- ·The vulnerability does not exist when running Java 15 or higher; detection/blocking efforts are only relevant for Java 14 and below. ↗
- ·Users who have configured XStream's Security Framework with a whitelist are not affected; the SSRF vector only applies to deployments relying on XStream's default blacklist. ↗
- ·OpenShift Container Platform jenkins package is not affected due to JEP-200 and SECURITY-383 mitigations already in place. ↗
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.0HIGH
vendor_debian6.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2024-08-22·CVSS 7.5
CVE-2021-21342 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream.
It was discovered that XStream incorrectly handled parsing of certain
crafted XML documents. A remote attacker could possibly use this issue to
read arbitrary files. (CVE-2016-3674)
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery
attacks. A remote attacker could request data from internal resources
that are not publicly available only by manipulating the processed input
stream. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion
on the local host.
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2021-05-11·CVSS 8.0
CVE-2020-26258 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream library.
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. This issue affected only affected
Ubuntu 20.10. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream. This
issue only affected Ubuntu 20.10. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2021-01-28·CVSS 8.0
CVE-2020-26217 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in libxstream-java.
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream.
(CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulating the processed input s
Red Hat
XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling
vendor_redhat·2020-12-13·CVSS 8.8
CVE-2020-26258 [HIGH] CWE-918 XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling
XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately sw
Debian
CVE-2020-26258: libxstream-java - XStream is a Java library to serialize objects to XML and back again. In XStream...
vendor_debian·2020·CVSS 6.3
CVE-2020-26258 [MEDIUM] CVE-2020-26258: libxstream-java - XStream is a Java library to serialize objects to XML and back again. In XStream...
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1
OSV
libxstream-java vulnerabilities
osv·2024-08-22·CVSS 7.5
CVE-2016-3674 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
It was discovered that XStream incorrectly handled parsing of certain
crafted XML documents. A remote attacker could possibly use this issue to
read arbitrary files. (CVE-2016-3674)
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery
attacks. A remote attacker could request data from internal resources
that are not publicly available only by manipulating the processed input
stream. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion
on the local host. A remote attacker could use this to delete arbitrary
kn
OSV
libxstream-java vulnerabilities
osv·2021-05-11·CVSS 8.8
CVE-2020-26217 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. This issue affected only affected
Ubuntu 20.10. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream. This
issue only affected Ubuntu 20.10. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulatin
OSV
libxstream-java vulnerabilities
osv·2021-01-28·CVSS 8.8
CVE-2020-26217 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream.
(CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulating the processed input stream. (CVE-2020-26259)
GHSA
Server-Side Forgery Request can be activated unmarshalling with XStream
ghsa·2020-12-21
CVE-2020-26258 [MEDIUM] CWE-918 Server-Side Forgery Request can be activated unmarshalling with XStream
Server-Side Forgery Request can be activated unmarshalling with XStream
### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.15.
### Workarounds
The reported vulnerability does not exist running Java 15 or higher.
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.
Users of XStream 1.4.14 or below wh
OSV
Server-Side Forgery Request can be activated unmarshalling with XStream
osv·2020-12-21
CVE-2020-26258 [MEDIUM] Server-Side Forgery Request can be activated unmarshalling with XStream
Server-Side Forgery Request can be activated unmarshalling with XStream
### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.15.
### Workarounds
The reported vulnerability does not exist running Java 15 or higher.
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.
Users of XStream 1.4.14 or below wh
OSV
CVE-2020-26258: XStream is a Java library to serialize objects to XML and back again
osv·2020-12-16·CVSS 7.7
CVE-2020-26258 [HIGH] CVE-2020-26258: XStream is a Java library to serialize objects to XML and back again
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1
No detection rules found.
Nuclei
XStream <1.4.15 - Server-Side Request Forgery
nuclei·CVSS 7.7
CVE-2020-26258 [HIGH] XStream <1.4.15 - Server-Side Request Forgery
XStream
0
http://{{interactsh-url}}/internal/:
0
test
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: Java"
# digest: 4a0a0047304502200de317ad30fdb9a2f5ba7ce7a6ddadba707347b0c9a53680699785193bcb9232022100fe76483555857634948299bf8056fbd0122de9438a7a31f5f9cfb76bd904d443:922c64590222798bb761d5b6d8e72950
https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34@%3Ccommits.struts.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/12/msg00042.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHPhttps://lists.fedoraproject.org/archives/list/[email protected]/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7https://lists.fedoraproject.org/archives/list/[email protected]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREBhttps://security.netapp.com/advisory/ntap-20210409-0005https://www.debian.org/security/2021/dsa-4828https://x-stream.github.io/CVE-2020-26258.htmlhttps://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34%40%3Ccommits.struts.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/12/msg00042.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210409-0005/https://www.debian.org/security/2021/dsa-4828https://x-stream.github.io/CVE-2020-26258.html
2020-12-16
Published