CVE-2013-7285 Command Injection in Xstream

What is CVE-2013-7285?

CVE-2013-7285 is a critical command injection vulnerability in Apache Activemq, published on 15 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

Weakness: CWE-78

Which versions are affected by CVE-2013-7285?

4 open source packages ship an affected version, including com.thoughtworks.xstream:xstream. It affects 3 products.

Products include Apache Activemq, Oracle Endeca Information Discovery Studio, Xstream Xstream.

How do I fix CVE-2013-7285?

Upgrade com.thoughtworks.xstream:xstream to a fixed version for your release line: 1.4.7 or 1.4.11.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2013-7285 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-7285 exists.

Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in Apache Activemq

• CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted Data Exploited Critical 10.0
• CVE-2016-3088 Apache ActiveMQ Improper Input Validation Exploited Critical 9.8
• CVE-2026-34197 Apache ActiveMQ Improper Input Validation Exploited High 8.8
• CVE-2020-11998 Remote code execution in Apache ActiveMQ Critical 9.8
• CVE-2014-3600 Improper Restriction of XML External Entity Reference in Apache ActiveMQ Critical 9.8

All Apache Activemq vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-7285, GHSA-f554-x222-wgf7, MGASA-2014-0100, RHSA-2014:0389, UBUNTU-CVE-2013-7285.