{"id":18559,"date":"2021-10-15T08:41:41","date_gmt":"2021-10-15T08:41:41","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=18559"},"modified":"2021-10-15T08:41:41","modified_gmt":"2021-10-15T08:41:41","slug":"xstream-multiple-high-risk-vulnerabilities-threat-alert-2","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/xstream-multiple-high-risk-vulnerabilities-threat-alert-2\/","title":{"rendered":"XStream Multiple High-Risk Vulnerabilities Threat Alert"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

Recently, NSFOCUS found that XStream released security advisories disclosing 14 security vulnerabilities in its products. An attacker could exploit these vulnerabilities to conduct a DoS, server-side request forgery (SSRF), or remote code execution (RCE) attack.<\/p>\n\n\n\n

XStream is a tool to serialize Java objects to XML and back again. When serializing JavaBeans or deserializing XML files, it does not require other auxiliary classes and mapping files, which makes XML serialization no longer cumbersome.<\/p>\n\n\n\n

CVE-2021-39140:<\/p>\n\n\n\n

An attacker can manipulate the processed input stream and replace or inject an object, which can cause an endless loop resulting in a denial of service.<\/p>\n\n\n\n

CVE-2021-39144:<\/p>\n\n\n\n

An attacker can manipulate the processed input stream and replace or inject objects, thus resulting in remote command execution on the server.<\/p>\n\n\n\n

CVE-2021-39139, CVE-2021-39141, CVE-2021-39145, CVE-2021-39146, CVE-2021-39147, CVE-2021-39148, CVE-2021-39149, CVE-2021-39151, CVE-2021-39153, and CVE-2021-39154<\/p>\n\n\n\n

An attacker can manipulate the processed input stream and replace or inject objects, thus resulting in execution of arbitrary code loaded from a remote server.<\/p>\n\n\n\n

CVE-2021-39150, CVE-2021-39152:<\/p>\n\n\n\n

An attacker can manipulate the processed input stream and replace or inject objects, resulting in a SSRF.<\/p>\n\n\n\n

Reference link: https:\/\/x-stream.github.io\/security.html#workaround<\/a><\/p>\n\n\n\n

Scope of Impact<\/h2>\n\n\n\n

Affected Versions<\/strong><\/p>\n\n\n\n