critical
9.3
CWE
78 502
Advisory Published
CVE Published
CVE Published
Updated

CVE-2020-26217: Remote Code Execution in XStream

First published: Mon Nov 16 2020(Updated: )

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Credit: security-advisories@github.com security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
redhat/xstream<0:1.3.1-12.el7_9
0:1.3.1-12.el7_9
redhat/xstream<1.4.14
1.4.14
debian/libxstream-java
1.4.15-3+deb11u2
1.4.15-3+deb11u3
1.4.20-1+deb12u1
1.4.21-1
IBM Rational DOORS Next Generation<=6.0.2
IBM Rational DOORS Next Generation<=7.0
IBM Rational DOORS Next Generation<=7.0.1
IBM Rational DOORS Next Generation<=7.0.2
IBM Rational DOORS Next Generation<=6.0.6.1
IBM Rational DOORS Next Generation<=6.0.6
IBM Pub<=7.0.1
IBM Pub<=7.0.2
IBM Pub<=7.0
IBM Engineering Workflow Management (EWM)<=7.0.2
IBM Engineering Workflow Management (EWM)<=7.0.1
IBM Rational Team Concert<=6.0.2
IBM Rational Team Concert<=6.0.6.1
IBM Engineering Workflow Management (EWM)<=7.0
IBM Rational Team Concert<=6.0.6
IBM Global Configuration Management<=All
IBM Engineering Test Management (ETM)<=7.0.2
IBM Rational Quality Manager (RQM)<=6.0.6.1
IBM Engineering Test Management (ETM)<=7.0.1
IBM Rational Quality Manager (RQM)<=6.0.6
IBM Engineering Test Management (ETM)<=7.0.0
IBM Rational Quality Manager (RQM)<=6.0.2
IBM Engineering Requirements Quality Assistant<=All
XStream<1.4.14
Debian Linux=9.0
Debian Linux=10.0
NetApp SnapManager for SAP
NetApp SnapManager for Oracle
Apache ActiveMQ=5.15.4
Oracle Cash Management=14.2
Oracle Cash Management=14.3
Oracle Cash Management=14.5
Oracle Banking Corporate Lending=14.2
Oracle Banking Corporate Lending=14.3
Oracle Banking Corporate Lending=14.5
Oracle Banking Credit Facilities Process Management=14.2
Oracle Banking Credit Facilities Process Management=14.3
Oracle Banking Credit Facilities Process Management=14.5
Oracle Banking Platform=2.4.0
Oracle Banking Platform=2.7.1
Oracle Banking Platform=2.9.0
Oracle Banking Supply Chain Finance=14.2
Oracle Banking Supply Chain Finance=14.3
Oracle Banking Supply Chain Finance=14.5
Oracle Banking Trade Finance Process Management=14.2
Oracle Banking Trade Finance Process Management=14.3
Oracle Banking Trade Finance Process Management=14.5
Oracle Banking Virtual Account Management=14.2.0
Oracle Banking Virtual Account Management=14.3.0
Oracle Banking Virtual Account Management=14.5.0
Oracle Business Activity Monitoring=11.1.1.9.0
Oracle Business Activity Monitoring=12.2.1.3.0
Oracle Business Activity Monitoring=12.2.1.4.0
Oracle Communications Policy Management=12.5.0
Oracle Endeca Information Discovery Studio=3.2.0.0
Oracle Retail Xstore Office Cloud Service=16.0.6
Oracle Retail Xstore Office Cloud Service=17.0.4
Oracle Retail Xstore Office Cloud Service=18.0.3
Oracle Retail Xstore Office Cloud Service=19.0.2

Remedy

https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a

Remedy

https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9@%3Ccommits.camel.apache.org%3E

Remedy

https://www.oracle.com//security-alerts/cpujul2021.html

Remedy

https://www.oracle.com/security-alerts/cpuApr2021.html

Remedy

https://www.oracle.com/security-alerts/cpuoct2021.html

Remedy

Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list approach may not address. Allow list approach ```java XStream xstream = new XStream(); XStream.setupDefaultSecurity(xstream); xstream.allowTypesByWildcard(new String[] {"com.misc.classname"}) ``` Deny list for XStream 1.4.13 ```java xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class }); ``` Deny list for XStream 1.4.7 -> 1.4.12 ```java xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class }); ``` Deny list for versions prior to XStream 1.4.7 ```java xstream.registerConverter(new Converter() { public boolean canConvert(Class type) { return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || Proxy.isProxy(type)); } public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } }, XStream.PRIORITY_LOW); ```

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is CVE-2020-26217?

    CVE-2020-26217 is a vulnerability in XStream before version 1.4.14 that allows remote code execution.

  • How severe is CVE-2020-26217?

    CVE-2020-26217 has a severity rating of critical (9 out of 10).

  • How can a remote attacker exploit CVE-2020-26217?

    A remote attacker can exploit CVE-2020-26217 by manipulating the processed input stream to run arbitrary shell commands.

  • Which systems are affected by CVE-2020-26217?

    Systems using XStream before version 1.4.14 and relying on blocklists are affected by CVE-2020-26217.

  • How can I fix CVE-2020-26217?

    To fix CVE-2020-26217, update XStream to version 1.4.14 or apply the appropriate patches provided by the vendor.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203