CVE-2020-26258

A Server-Side Forgery Request can be activated unmarshalling with XStream

Severity Score

7.7

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.

XStream es una biblioteca de Java para serializar objetos a XML y viceversa. En XStream versiones anteriores a 1.4.15, puede ser activada una vulnerabilidad de tipo Server-Side Forgery Request al desagrupar. La vulnerabilidad puede permitir a un atacante remoto solicitar datos de recursos internos que no están disponibles públicamente solo mediante la manipulación del flujo de entrada procesado. Si confía en la lista negra predeterminada de XStream del Security Framework, tendrá que usar al menos la versión 1.4.15. La vulnerabilidad reportada no existe si se ejecuta Java versión 15 o superior. Ningún usuario es afectado si siguió la recomendación de configurar el Security Framework de XStream con una lista blanca! Cualquiera que confíe en la lista negra predeterminada de XStream puede cambiar inmediatamente a una lista blanca para los tipos permitidos para evitar la vulnerabilidad. Usuarios de XStream 1.4 o por debajo, quienes aún quieran usar la lista negra predeterminada de XStream pueden usar una solución alternativa que se describe con más detalle en los avisos a los que se hace referencia

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-10-01 CVE Reserved
2020-12-16 CVE Published
2021-01-22 First Exploit
2024-08-04 CVE Updated
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-918: Server-Side Request Forgery (SSRF)

CAPEC

References (12)

URL	Tag	Source
https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28	Mitigation
https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34%40%3Ccommits.struts.apache.org%3E	Mailing List
https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html	Mailing List
https://security.netapp.com/advisory/ntap-20210409-0005	Third Party Advisory

URL	Date	SRC
https://github.com/Al1ex/CVE-2020-26258	2021-01-22
https://x-stream.github.io/CVE-2020-26258.html	2024-08-04

URL	Date	SRC

URL	Date	SRC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB	2023-11-07
https://www.debian.org/security/2021/dsa-4828	2023-11-07
https://access.redhat.com/security/cve/CVE-2020-26258	2021-11-23
https://bugzilla.redhat.com/show_bug.cgi?id=1908832	2021-11-23

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Xstream Project Search vendor "Xstream Project"		Xstream Search vendor "Xstream Project" for product "Xstream"				< 1.4.15 Search vendor "Xstream Project" for product "Xstream" and version " < 1.4.15"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				33 Search vendor "Fedoraproject" for product "Fedora" and version "33"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				34 Search vendor "Fedoraproject" for product "Fedora" and version "34"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				35 Search vendor "Fedoraproject" for product "Fedora" and version "35"		-		Affected