CVE-2013-7285 Command Injection in Xstream
CriticalCVSS 9.8
EPSS 84.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.thoughtworks.xstream/xstream(Maven) | < 1.4.7 | 1.4.7 |
| com.thoughtworks.xstream/xstream(Maven) | = 0.1 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 0.2 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 0.3 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 0.5 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 0.6 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.0 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.0.1 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.0.2 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.1 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.1.1 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.1.2 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.1.3 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.2 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.2.1 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.2.2 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.3 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.3.1 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.4 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.4.1 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.4.2 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.4.3 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.4.4 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.4.5 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.4.6 | No fix listed |
Show 10 more
| Product | Affected versions | Fixed in |
|---|---|---|
| com.thoughtworks.xstream/xstream(Maven) | >= 1.4.10, < 1.4.11 | 1.4.11 |
| com.thoughtworks.xstream/xstream(Maven) | = 1.4.10 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.4.10-java7 | No fix listed |
| debian/libxstream-java(Debian:12) | < 1.4.7-1 | 1.4.7-1 |
| debian/libxstream-java(Debian:13) | < 1.4.7-1 | 1.4.7-1 |
| debian/libxstream-java(Debian:14) | < 1.4.7-1 | 1.4.7-1 |
| oracle endeca information discovery studio | = 3.2.0 | No fix listed |
| apache activemq | = 5.15.8 | No fix listed |
| xstream | <= 1.4.6 | No fix listed |
| xstream | = 1.4.10 | No fix listed |
References
- Debian Security Tracker CVE-2013-7285 vendor-advisory
- bugs.debian.org issue-tracking
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- lists.apache.org
- lists.apache.org
- www.mail-archive.com
- www.mail-archive.com
- www.oracle.com third-party-advisory
- x-stream.github.io exploit third-party-advisory
- blog.diniscruz.com broken-link not-applicable url-repurposed
- [oss-security] 20140109 Re: CVE request: remote code execution via deserialization in XStream mailing-list third-party-advisory
- web.archive.org third-party-advisory
- github.com
- [xstream-user] 20130717 Re: Is it possible to unregister the DynamicProxyConverter using the SpringOXM wrapper mailing-list third-party-advisory
- [xstream-user] 20130718 Re: Is it possible to unregister the DynamicProxyConverter using the SpringOXM wrapper mailing-list third-party-advisory
- [activemq-issues] 20190718 [jira] [Updated] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework) and xstream-1.4.10.jar mailing-list
- [activemq-issues] 20190826 [jira] [Created] (AMQ-7288) Security Vulnerabilities in ActiveMQ dependent libraries. mailing-list