logo

Database

OS Command Injection In com.thoughtworks.xstream:xstream

Description

Command Injection in Xstream Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2013-72852. NVD-2013-72853. OSV-2013-72854. OSV-DEBIAN-2013-72855. GCVE-2013-72856. SECURITY-TRACKER-CVE-2013-72857. BUGZILLA-CVE-2013-7285

References

1. https://github.com/x-stream/xstream/commit/6344867dce6767af7d0fe34fb393271a6456672d2. https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1@%3Cissues.activemq.apache.org%3E3. https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E4. https://www.mail-archive.com/[email protected]/msg00604.html5. https://www.mail-archive.com/[email protected]/msg00607.html6. https://www.oracle.com/security-alerts/cpuoct2020.html7. https://x-stream.github.io/CVE-2013-7285.html8. http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html9. http://seclists.org/oss-sec/2014/q1/6910. http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html11. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-7285.yaml12. https://github.com/shoucheng3/x-stream__xstream_CVE-2013-7285_1-4-613. https://fisheye.codehaus.org/changelog/xstream?cs=2210

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.