CVE-2020-26259
published 2020-12-16CVE-2020-26259: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the…
PriorityP357medium6.8CVSS 3.1
AVNACHPRNUINSCCNIHAN
EPSS
82.39%
99.6th percentile
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | < 6.0.0 | 6.0.0 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libxstream-java | < libxstream-java 1.4.15-1 (bookworm) | libxstream-java 1.4.15-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| x-stream | xstream | < 1.4.15 | 1.4.15 |
| xstream | xstream | < 1.4.15 | 1.4.15 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring XStream deserialization input streams for the type string 'jdk.nashorn.internal.objects.NativeString', which is part of the exploit chain. ↗
- →Flag any XStream unmarshalling of XML payloads containing 'javax.imageio.ImageIO$ContainsFilter', 'java.lang.ProcessBuilder', 'java.beans.EventHandler', or 'java.lang.Void' type references as potentially malicious gadget chains. ↗
- ·The vulnerability does not affect Java 15 or higher; detection/blocking efforts are only relevant for environments running Java 14 or below. ↗
- ·Users who have configured XStream's Security Framework with a whitelist are not affected; detection focus should be on deployments using the default blacklist or no security framework configuration. ↗
- ·OpenShift Container Platform jenkins package is not affected due to JEP-200 and SECURITY-383 mitigations; do not apply XStream-specific detections to OCP jenkins deployments. ↗
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P
osv8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.0HIGH
vendor_debian6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
libxstream-java vulnerabilities
osv·2024-08-22·CVSS 7.5
CVE-2016-3674 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
It was discovered that XStream incorrectly handled parsing of certain
crafted XML documents. A remote attacker could possibly use this issue to
read arbitrary files. (CVE-2016-3674)
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery
attacks. A remote attacker could request data from internal resources
that are not publicly available only by manipulating the processed input
stream. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion
on the local host. A remote attacker could use this to delete arbitrary
kn
OSV
libxstream-java vulnerabilities
osv·2021-05-11·CVSS 8.8
CVE-2020-26217 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. This issue affected only affected
Ubuntu 20.10. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream. This
issue only affected Ubuntu 20.10. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulatin
OSV
libxstream-java vulnerabilities
osv·2021-01-28·CVSS 8.8
CVE-2020-26217 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream.
(CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulating the processed input stream. (CVE-2020-26259)
OSV
XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
osv·2020-12-21
CVE-2020-26259 [MEDIUM] XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
### Impact
The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.15.
### Workarounds
The reported vulnerability does only exist with a JAX-WS runtime on the classpath.
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid th
GHSA
XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
ghsa·2020-12-21
CVE-2020-26259 [MEDIUM] CWE-78 XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
XStream vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
### Impact
The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.15.
### Workarounds
The reported vulnerability does only exist with a JAX-WS runtime on the classpath.
No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid th
OSV
CVE-2020-26259: XStream is a Java library to serialize objects to XML and back again
osv·2020-12-16·CVSS 6.8
CVE-2020-26259 [MEDIUM] CVE-2020-26259: XStream is a Java library to serialize objects to XML and back again
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerabi
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2024-08-22·CVSS 7.5
CVE-2021-21342 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream.
It was discovered that XStream incorrectly handled parsing of certain
crafted XML documents. A remote attacker could possibly use this issue to
read arbitrary files. (CVE-2016-3674)
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery
attacks. A remote attacker could request data from internal resources
that are not publicly available only by manipulating the processed input
stream. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion
on the local host.
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2021-05-11·CVSS 8.0
CVE-2020-26258 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream library.
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. This issue affected only affected
Ubuntu 20.10. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream. This
issue only affected Ubuntu 20.10. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2021-01-28·CVSS 8.0
CVE-2020-26217 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in libxstream-java.
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream.
(CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulating the processed input s
Red Hat
XStream: arbitrary file deletion on the local host when unmarshalling
vendor_redhat·2020-12-13·CVSS 8.8
CVE-2020-26259 [HIGH] CWE-78 XStream: arbitrary file deletion on the local host when unmarshalling
XStream: arbitrary file deletion on the local host when unmarshalling
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immedia
Debian
CVE-2020-26259: libxstream-java - XStream is a Java library to serialize objects to XML and back again. In XStream...
vendor_debian·2020·CVSS 6.8
CVE-2020-26259 [MEDIUM] CVE-2020-26259: libxstream-java - XStream is a Java library to serialize objects to XML and back again. In XStream...
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerabi
No detection rules found.
No public exploits indexed.
https://github.com/x-stream/xstream/security/advisories/GHSA-jfvx-7wrx-43fhhttps://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34%40%3Ccommits.struts.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/12/msg00042.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210409-0005/https://www.debian.org/security/2021/dsa-4828https://x-stream.github.io/CVE-2020-26259.htmlhttps://github.com/x-stream/xstream/security/advisories/GHSA-jfvx-7wrx-43fhhttps://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34%40%3Ccommits.struts.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/12/msg00042.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210409-0005/https://www.debian.org/security/2021/dsa-4828https://x-stream.github.io/CVE-2020-26259.html
2020-12-16
Published