OS Command Injection in xstream - CVE-2020-26217

Vulnerability identifier: #VU49039

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-26217

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation, when processing blacklists. A remote user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

xstream
xstream (Red Hat package)
libxstream-java (Debian package)
libxstream-java (Ubuntu package)
prometheus-formula
grafana-formula
prometheus-exporters-formula
subscription-matcher
xpp3
xpp3-minimal
xstream
smdba
cobbler
susemanager-docs_en
susemanager-docs_en-pdf
susemanager-doc-indexes
python3-rhnlib
spacewalk-proxy-package-manager
spacewalk-proxy-salt
spacewalk-proxy-redirect
spacewalk-proxy-broker
spacewalk-proxy-management
spacewalk-proxy-common
python3-mgr-osa-common
python3-mgr-osa-dispatcher
mgr-osa-dispatcher
mgr-osad
python3-mgr-osad
spacewalk-config
spacewalk-proxy-installer
mgr-libmod
spacewalk-client-setup
spacewalk-check
python3-spacewalk-client-setup
python3-spacewalk-check
python3-spacewalk-client-tools
spacewalk-client-tools
spacewalk-utils
spacewalk-utils-extras
susemanager-schema
susemanager-sls
uyuni-config-modules
spacewalk-backend
spacewalk-backend-app
spacewalk-backend-applet
spacewalk-backend-config-files
spacewalk-backend-config-files-tool
spacewalk-backend-config-files-common
spacewalk-backend-iss
spacewalk-backend-iss-export
spacewalk-backend-package-push-server
spacewalk-backend-sql
spacewalk-backend-server
spacewalk-backend-sql-postgresql
spacewalk-backend-tools
spacewalk-backend-xmlrpc
spacewalk-backend-xml-export-libs
spacewalk-base
susemanager-web-libs
spacewalk-base-minimal
spacewalk-base-minimal-config
spacewalk-html
susemanager
susemanager-tools
spacewalk-java-lib
spacewalk-java
spacewalk-taskomatic
spacewalk-java-postgresql
spacewalk-java-config
py26-compat-salt
Oracle Banking Platform
Storage Copy Data Management
Oracle Endeca Information Discovery Studio
Oracle Business Activity Monitoring
SUSE Linux Enterprise Module for SUSE Manager Proxy
SUSE Linux Enterprise Module for SUSE Manager Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
CentOS
Ubuntu
Bamboo Server
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Security Verify Governance
Fuse

Install updates from vendor's website.

xstream - update to 1.4.14
xstream (Red Hat package) - update to 1.3.1-12.el7_9
Bamboo Server - update to 9.2.8
libxstream-java (Debian package) - update to 1.4.11.1-1+deb10u1
libxstream-java (Ubuntu package) - addressed in versions 1.4.7-1ubuntu0.1+esm2, 1.4.8-1ubuntu0.1+esm3, 1.4.11.1-1~18.04.1, 1.4.11.1-1~18.04.2, 1.4.11.1-1ubuntu0.1, 1.4.11.1-1ubuntu0.2, 1.4.11.1-2ubuntu0.1, 1.4.15-1ubuntu0.1
prometheus-formula - update to 0.3.1-3.6.2
grafana-formula - update to 0.4.0-3.6.2
prometheus-exporters-formula - update to 0.9.0-3.19.2
subscription-matcher - update to 0.26-3.6.2
xpp3 - update to 1.1.4c-11.2.2
xpp3-minimal - update to 1.1.4c-11.2.2
xstream - update to 1.4.15-3.5.2
smdba - update to 1.7.8-0.3.6.2
cobbler - update to 3.0.0+git20190806.32c4bae0-5.6.4
susemanager-docs_en - update to 4.1-11.28.2
susemanager-docs_en-pdf - update to 4.1-11.28.2
susemanager-doc-indexes - update to 4.1-11.28.4
python3-rhnlib - update to 4.1.3-4.3.2
spacewalk-proxy-package-manager - update to 4.1.4-3.9.4
spacewalk-proxy-salt - update to 4.1.4-3.9.4
spacewalk-proxy-redirect - update to 4.1.4-3.9.4
spacewalk-proxy-broker - update to 4.1.4-3.9.4
spacewalk-proxy-management - update to 4.1.4-3.9.4
spacewalk-proxy-common - update to 4.1.4-3.9.4
python3-mgr-osa-common - update to 4.1.5-2.9.4
python3-mgr-osa-dispatcher - update to 4.1.5-2.9.4
mgr-osa-dispatcher - update to 4.1.5-2.9.4
mgr-osad - update to 4.1.5-2.9.4
python3-mgr-osad - update to 4.1.5-2.9.4
spacewalk-config - update to 4.1.5-3.3.2
spacewalk-proxy-installer - update to 4.1.6-3.3.2
mgr-libmod - update to 4.1.7-3.16.2
spacewalk-client-setup - update to 4.1.9-4.12.4
spacewalk-check - update to 4.1.9-4.12.4
python3-spacewalk-client-setup - update to 4.1.9-4.12.4
python3-spacewalk-check - update to 4.1.9-4.12.4
python3-spacewalk-client-tools - update to 4.1.9-4.12.4
spacewalk-client-tools - update to 4.1.9-4.12.4
spacewalk-utils - update to 4.1.14-3.12.2
spacewalk-utils-extras - update to 4.1.14-3.12.2
susemanager-schema - update to 4.1.19-3.24.4
susemanager-sls - update to 4.1.21-3.26.2
uyuni-config-modules - update to 4.1.21-3.26.2
spacewalk-backend - update to 4.1.21-4.22.7
spacewalk-backend-app - update to 4.1.21-4.22.7
spacewalk-backend-applet - update to 4.1.21-4.22.7
spacewalk-backend-config-files - update to 4.1.21-4.22.7
spacewalk-backend-config-files-tool - update to 4.1.21-4.22.7
spacewalk-backend-config-files-common - update to 4.1.21-4.22.7
spacewalk-backend-iss - update to 4.1.21-4.22.7
spacewalk-backend-iss-export - update to 4.1.21-4.22.7
spacewalk-backend-package-push-server - update to 4.1.21-4.22.7
spacewalk-backend-sql - update to 4.1.21-4.22.7
spacewalk-backend-server - update to 4.1.21-4.22.7
spacewalk-backend-sql-postgresql - update to 4.1.21-4.22.7
spacewalk-backend-tools - update to 4.1.21-4.22.7
spacewalk-backend-xmlrpc - update to 4.1.21-4.22.7
spacewalk-backend-xml-export-libs - update to 4.1.21-4.22.7
spacewalk-base - update to 4.1.23-3.18.6
susemanager-web-libs - update to 4.1.23-3.18.6
spacewalk-base-minimal - update to 4.1.23-3.18.6
spacewalk-base-minimal-config - update to 4.1.23-3.18.6
spacewalk-html - update to 4.1.23-3.18.6
susemanager - update to 4.1.24-3.20.2
susemanager-tools - update to 4.1.24-3.20.2
spacewalk-java-lib - update to 4.1.30-3.31.7
spacewalk-java - update to 4.1.30-3.31.7
spacewalk-taskomatic - update to 4.1.30-3.31.7
spacewalk-java-postgresql - update to 4.1.30-3.31.7
spacewalk-java-config - update to 4.1.30-3.31.7
py26-compat-salt - update to 2016.11.10-6.11.2
Storage Copy Data Management - update to 2.2.26.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
Fuse - addressed in versions 6.3.0, 7.10.0
IBM Security Verify Governance - update to 10.0.1.0.2

• Exploit #5067 - CVE-2020-26217 (CVE-2020-26217 && XStream RCE) (January 24, 2021)
• Exploit #4942 - CVE-2020-26217-XStream-RCE-POC (CVE-2020-26217 XStream RCE POC) (December 16, 2020)

• https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a
• https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2
• https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html
• https://www.debian.org/security/2020/dsa-4811
• https://x-stream.github.io/CVE-2020-26217.html

• OS command injection in XStream
• Debian update for libxstream-java
• Red Hat Enterprise Linux 7 update for xstream
• CentOS 7 update for xstream
• Multiple vulnerabilities in Oracle Banking Platform
• Multiple vulnerabilities in Oracle Endeca Information Discovery Studio
• OS Command Injection in Oracle BAM (Business Activity Monitoring)
• Ubuntu update for libxstream-java
• Ubuntu update for libxstream-java
• SUSE update for SUSE Manager Server 4.1
• Multiple vulnerabilities in IBM Security Verify Governance
• Bamboo Data Center and Server update for RCE in xstream
• Ubuntu update for libxstream-java
• Multiple vulnerabilities in Fuse 6
• Multiple vulnerabilities in Fuse 7.10
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM Storage Copy Data Management