CVE-2020-26217

Impact

The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.

Patches

If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.14.

Workarounds

No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.

Users of XStream 1.4.13 or below who still want to use XStream default blacklist can use a workaround depending on their version in use.

Users of XStream 1.4.13 can simply add two lines to XStream's setup code:

xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });

Users of XStream 1.4.12 to 1.4.7 who want to use XStream with a black list will have to setup such a list from scratch and deny at least the following types: javax.imageio.ImageIO$ContainsFilter, java.beans.EventHandler, java.lang.ProcessBuilder, java.lang.Void and void.

xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });

Users of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:

xstream.registerConverter(new Converter() {
  public boolean canConvert(Class type) {
    return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || Proxy.isProxy(type));
  }

  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {
    throw new ConversionException("Unsupported type due to security reasons.");
  }

  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {
    throw new ConversionException("Unsupported type due to security reasons.");
  }
}, XStream.PRIORITY_LOW);

Credits

Chen L found and reported the issue to XStream and provided the required information to reproduce it. He was supported by Zhihong Tian and Hui Lu, both from Guangzhou University.

References

See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2020-26217.

For more information

If you have any questions or comments about this advisory:

• Open an issue in XStream
• Contact us at XStream Google Group

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

This update for xstream fixes the following issues:

xstream was updated to version 1.4.15.

• CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists (bsc#1180994).
• CVE-2020-26258: Fixed a server-side request forgery vulnerability (bsc#1180146).
• CVE-2020-26259: Fixed an arbitrary file deletion vulnerability (bsc#1180145).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the xstream-1.4.18-1.1 package on the GA media of openSUSE Tumbleweed.

This update for xstream fixes the following issues:

xstream was updated to version 1.4.15.

• CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists (bsc#1180994).
• CVE-2020-26258: Fixed a server-side request forgery vulnerability (bsc#1180146).
• CVE-2020-26259: Fixed an arbitrary file deletion vulnerability (bsc#1180145).

This update fixes the following issues:

cobbler:

• Fix string replacement for @@xyz@@
• Better performing string replacements

grafana-formula:

• Set supported to false for unsupported systems (bsc#1182001)
• Add SLES 15 SP3 and openSUSE Leap 15.3 to supported versions

mgr-libmod:

• Fix 'list_modules' JSON serialization (bsc#1182492)

mgr-osad:

• Adapt to new SSL implementation of rhnlib (bsc#1181807)

prometheus-exporters-formula:

• Add Ubuntu support for Prometheus exporters' reverse proxy

prometheus-formula:

• Set server hostname from pillar data (bsc#1180439)

py26-compat-salt:

• Do not crash when unexpected cmd output at listing patches (bsc#1181290)

rhnlib:

• Change SSL implementation to python ssl for better SAN and hostname matching support (bsc#1181807)

smdba:

• Do not remove the database if there is no backup and deal with manifest

spacewalk-backend:

• Open repomd files as binary (bsc#1173893)
• Fix requesting Release file in debian repos (bsc#1182006)
• Reposync: Fixed Kickstart functionality.
• Reposync: Fixed URLGrabber error handling.
• Reposync: Fix modular data handling for cloned channels (bsc#1177508)

spacewalk-client-tools:

• Adapt to new SSL implementation of rhnlib (bsc#1181807)

spacewalk-config:

• Increase apache ssl logs to include response code and process time

spacewalk-java:

• Homogenizes style in filter buttons, facilitating testability
• Cleanup sessions via SQL query instead of SQL function (bsc#1180224)
• Rebuild and improve rendering of error pages 404 and 500 pages (bsc#1181228)
• Fix user creation with pam auth and no password (bsc#1179579)
• Fix action chains for saltssh minions (bsc#1182200)
• FIX: Slow response of 'Software > Install' in Ubuntu minions (bsc#1181165)
• Do not call page decorator in HEAD requests (bsc#1181228)
• Add 'mgr_origin_server' to Salt pillar data (bsc#1180439)
• Ensure new files are synced just after writing them (bsc#1175660)
• Enable openscap auditing for salt systems in SSM (bsc#1157711)
• Detect debian products (bsc#1181416)
• Show packages from channels assigned to the targeted system (bsc#1181423)
• Add an API endpoint to allow/disallow scheduling irrelevant patches (bsc#1180757)
• Open raw output in new tab for ScriptRunAction (bsc#1180547)
• Default to preferred items per page in content lifecycle lists (bsc#1180558)
• Fix modular data handling for cloned channels (bsc#1177508)
• Fix: login gets an ISE when SSO is enabled (bsc#1181048)

spacewalk-utils:

• Fix modular data handling for cloned channels (bsc#1177508)

spacewalk-web:

• Replace CRLF in ssh priv key when bootstrapping (bsc#1182685)
• Upgrade immer to fix CVE-2020-28477
• Default to preferred items per page in content lifecycle lists (bsc#1180558)
• Fix sorting in content lifecycle projects and cluster tables (bsc#1180558)

susemanager:

• Add SLE 15 SP3 bootstrap repository definitions (bsc#1182008)
• Python3-dbus-python and dependencies not installed by default on JeOS SLE15 images, add them to the bootstrap repository list of packages for traditional (bsc#1182071)

susemanager-doc-indexes:

• Updated Command Line Registration with Salt section in the Client Configuration Guide for clarity.
• Adds openSUSE Leap SP migration to the SP migration section of the Client Configuration Guide
• Adds note that bootstrap procedure for selecting a parent channel is optional in Client Configuration Guide (bsc#1181635)
• Adds note about checking for valid UUIDs in fstab when backing up (bsc#1181814)
• Updated command for running configure proxy script when replacing a proxy
• Fixed bad SUSE Customer Center URL

susemanager-docs_en:

• Updated Command Line Registration with Salt section in the Client Configuration Guide for clarity.
• Adds openSUSE Leap SP migration to the SP migration section of the Client Configuration Guide
• Adds note that bootstrap procedure for selecting a parent channel is optional in Client Configuration Guide (bsc#1181635)
• Adds note about…

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. (CVE-2020-26217)

It was discovered that XStream was vulnerable to server-side forgery attacks. A remote attacker could request data from internal resources that are not publicly available only by manipulating the processed input stream. (CVE-2020-26258)

It was discovered that XStream was vulnerable to arbitrary file deletion on the local host. A remote attacker could use this to delete arbitrary known files on the host as long as the executing process had sufficient rights only by manipulating the processed input stream. (CVE-2020-26259)

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. This issue affected only affected Ubuntu 20.10. (CVE-2020-26217)

It was discovered that XStream was vulnerable to server-side forgery attacks. A remote attacker could request data from internal resources that are not publicly available only by manipulating the processed input stream. This issue only affected Ubuntu 20.10. (CVE-2020-26258)

It was discovered that XStream was vulnerable to arbitrary file deletion on the local host. A remote attacker could use this to delete arbitrary known files on the host as long as the executing process had sufficient rights only by manipulating the processed input stream. This issue only affected Ubuntu 20.10. (CVE-2020-26259)

It was discovered that XStream was vulnerable to denial of service, arbitrary code execution, arbitrary file deletion and server-side forgery attacks. A remote attacker could cause any of those issues by manipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342, CVE-2021-21343 CVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350, CVE-2021-21351)

It was discovered that XStream incorrectly handled parsing of certain crafted XML documents. A remote attacker could possibly use this issue to read arbitrary files. (CVE-2016-3674)

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. (CVE-2020-26217)

It was discovered that XStream was vulnerable to server-side forgery attacks. A remote attacker could request data from internal resources that are not publicly available only by manipulating the processed input stream. (CVE-2020-26258)

It was discovered that XStream was vulnerable to arbitrary file deletion on the local host. A remote attacker could use this to delete arbitrary known files on the host as long as the executing process had sufficient rights only by manipulating the processed input stream. (CVE-2020-26259)

It was discovered that XStream was vulnerable to denial of service, arbitrary code execution, arbitrary file deletion and server-side forgery attacks. A remote attacker could cause any of those issues by manipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350, CVE-2021-21351)