Deserialization of Untrusted Data in xstream - CVE-2021-29505

Vulnerability identifier: #VU54675

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-29505

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote user can pass specially crafted XML data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

xstream
xstream (Red Hat package)
xstream-benchmark
xstream-parent
xstream-hibernate
xstream
xstream-javadoc
SUSE Linux Enterprise Module for SUSE Manager Server
CentOS
SUSE Linux Enterprise Module for Development Tools
openEuler
Fedora
IBM Tivoli Netcool Configuration Manager
Oracle Retail Customer Insights
Storage Copy Data Management
Oracle Communications Unified Inventory Management
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Control
IBM Security Verify Governance
Oracle Business Activity Monitoring
Oracle WebCenter Sites
Oracle WebCenter Portal
JBoss Data Grid

Install updates from vendor's website.

xstream - update to 1.4.17
xstream (Red Hat package) - update to 1.3.1-14.el7_9
IBM Tivoli Netcool Configuration Manager - update to 6.4.2.14
xstream-benchmark - update to 1.4.17-1
xstream-parent - update to 1.4.17-1
xstream-hibernate - update to 1.4.17-1
xstream - update to 1.4.17-1
xstream-javadoc - update to 1.4.17-1
xstream - update to 1.4.17-3.11.2
xstream - addressed in versions 1.4.18-2.fc33, 1.4.18-2.fc34, 1.4.18-2.fc35
Storage Copy Data Management - update to 2.2.26.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
IBM Spectrum Control - update to 5.4.4
JBoss Data Grid - update to 8.3.0
IBM Security Verify Governance - update to 10.0.1.0.2

• Exploit #6708 - CVE-2021-29505 (对CVE-2021-29505进行复现，并分析学了下Xstream反序列化过程) (September 5, 2021)

• https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc
• https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f
• https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f@%3Cdev.jmeter.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html

• Remote code execution in XStream
• Red Hat Enterprise Linux 7 update for xstream
• CentOS 7 update for xstream
• Deserialization of Untrusted Data in Oracle WebCenter Portal
• Deserialization of Untrusted Data in Oracle Business Activity Monitoring
• Multiple vulnerabilities in Oracle WebCenter Sites
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• SUSE update for xstream
• Multiple vulnerabilities in Oracle Retail Customer Insights
• Multiple vulnerabilities in IBM Spectrum Control
• Remote code execution in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM Security Verify Governance
• openEuler 20.03 LTS SP1 update for xstream
• Multiple vulnerabilities in JBoss Data Grid 8.3
• Fedora 35 update for xstream
• Fedora 33 update for xstream
• Fedora 34 update for xstream
• Fedora 33 update for xstream
• Fedora 34 update for xstream
• Fedora 35 update for xstream
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM Storage Copy Data Management