CVE-2020-26217 Remote Code Execution in XStream
Remote attackers can execute arbitrary shell commands via manipulated input streams in XStream if relying on blocklists instead of allowlists.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-26217?
CVE-2020-26217 is a high-severity command injection vulnerability in Apache Activemq, published on 16 Nov 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Weakness: CWE-78
Which versions are affected by CVE-2020-26217?
3 open source packages ship an affected version, including activemq and com.thoughtworks.xstream:xstream. It affects 15 products.
| Package | Affected | Fixed in |
|---|---|---|
activemq Bitnami | All versions to 5.16.0 | 5.15.14 |
com.thoughtworks.xstream:xstream Maven | All versions | 1.4.14-java7 |
com.thoughtworks.xstream:xstream Maven | All versions | 1.4.14-java7 |
Linux distribution packages (8)
xstream Red Hat:enterprise_linux:7::client | All versions | 0:1.3.1-12.el7_9 |
xstream-javadoc Red Hat:enterprise_linux:7::client | All versions | 0:1.3.1-12.el7_9 |
xstream Red Hat:enterprise_linux:7::computenode | All versions | 0:1.3.1-12.el7_9 |
xstream-javadoc Red Hat:enterprise_linux:7::computenode | All versions | 0:1.3.1-12.el7_9 |
xstream Red Hat:enterprise_linux:7::server | All versions | 0:1.3.1-12.el7_9 |
xstream-javadoc Red Hat:enterprise_linux:7::server | All versions | 0:1.3.1-12.el7_9 |
xstream Red Hat:enterprise_linux:7::workstation | All versions | 0:1.3.1-12.el7_9 |
xstream-javadoc Red Hat:enterprise_linux:7::workstation | All versions | 0:1.3.1-12.el7_9 |
Products include Apache Activemq, Debian Debian Linux, Netapp Snapmanager, Oracle Banking Cash Management, Oracle Banking Corporate Lending Process Management, Oracle Banking Credit Facilities Process Management and 9 more.
How do I fix CVE-2020-26217?
Upgrade activemq to 5.15.14 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-26217 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-26217 exists.
Public exploit code: 1 Nuclei template and 6 proofs of concept on GitHub.
Other vulnerabilities in Apache Activemq
Sources
Also known as BIT-activemq-2020-26217, DEBIAN-CVE-2020-26217, DLA-2471-1, DSA-4811-1, GHSA-mw36-7c6c-q4q2, RHSA-2021:0162 and 1 more.