CVE-2020-26258 Server-Side Forgery Request can be activated unmarshalling with XStream
Remote attackers can trigger Server-Side Request Forgery in XStream when unmarshalling XML if using the default blacklist configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-26258?
CVE-2020-26258 is a medium-severity server-side request forgery vulnerability in Apache Struts, published on 16 Dec 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
Weakness: CWE-918
Which versions are affected by CVE-2020-26258?
2 open source packages ship an affected version, including com.thoughtworks.xstream:xstream. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
com.thoughtworks.xstream:xstream Maven | All versions | 1.4.15 |
com.thoughtworks.xstream:xstream Maven | All versions | 1.4.15 |
Products include Apache Struts, Debian Debian Linux, Fedoraproject Fedora, Xstream Xstream.
How do I fix CVE-2020-26258?
Upgrade com.thoughtworks.xstream:xstream to 1.4.15 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-26258 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-26258 exists.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Apache Struts
Sources
Also known as DEBIAN-CVE-2020-26258, GHSA-4cch-wxpw-8p28, UBUNTU-CVE-2020-26258.