From d00f4f8ca6719a0d832a99e3b9a1dc0e35b5f85d Mon Sep 17 00:00:00 2001
From: ut001695 CVE-2021-43859: XStream can cause a Denial of Service by injecting highly recursive collections or maps. All versions until and including version 1.4.18 are affected. The processed stream at unmarshalling time contains type information to recreate the formerly written objects.
-+ XStream creates therefore new instances based on these type information. An attacker can manipulate the processed
-+ input stream and replace or inject objects, that result in exponential recursively hashcode calculation, causing a denial
-+ of service. The attack uses the hashcode implementation of collection types in the Java runtime. Following types are affected with
-+ lastest Java versions available in December 2021: Create a simple HashSet and use XStream to marshal it to XML. Replace the XML with following snippet, increase the
-+ depth of the structure and unmarshal it with XStream: Create a simple HashMap and use XStream to marshal it to XML. Replace the XML with following snippet, increase the
-+ depth of the structure and unmarshal it with XStream: As soon as the XML is unmarshalled, the hash codes of the elements are calculated and the calculation time increases
-+ exponentially due to the highly recursive structure. Note, this example uses XML, but the attack can be performed for any supported format, that supports references, i.e.
-+ JSON is not affected. The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU
-+ type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed
-+ input stream. If your object graph does not use referenced elements at all, you may simply set the NO_REFERENCE mode: If your object graph contains neither a Hashtable, HashMap nor a HashSet (or one of the linked variants of it) then you
-+ can use the security framework to deny the usage of these types: Unfortunately these types are very common. If you only use HashMap or HashSet and your XML refers these only as default
-+ map or set, you may additionally change the default implementation of java.util.Map and java.util.Set at unmarshalling time: However, this implies that your application does not care about the implementation of the map and all elements are comparable. r00t4dm at Cloud-Penetrating Arrow Lab found and reported the issue to XStream and provided the required information to
-+ reproduce it.Vulnerability
-+
-+ Affected Versions
-+
-+ Description
-+
-+ Steps to Reproduce
-+
-+
-+
-+ <set>
-+ <set>
-+ <string>a</string>
-+ <set>
-+ <string>a</string>
-+ <set>
-+ <string>a</string>
-+ </set>
-+ <set>
-+ <string>b</string>
-+ </set>
-+ </set>
-+ <set>
-+ <set reference="../../set/set"/>
-+ <string>b</string>
-+ <set reference="../../set/set[2]"/>
-+ </set>
-+ </set>
-+ <set>
-+ <set reference="../../set/set"/>
-+ <string>b</string>
-+ <set reference="../../set/set[2]"/>
-+ </set>
-+</set>
-+
XStream xstream = new XStream();
-+xstream.fromXML(xml);
-+
<map>
-+ <entry>
-+ <map>
-+ <entry>
-+ <string>a</string>
-+ <string>b</string>
-+ </entry>
-+ <entry>
-+ <map>
-+ <entry>
-+ <string>a</string>
-+ <string>b</string>
-+ </entry>
-+ <entry>
-+ <map>
-+ <entry>
-+ <string>a</string>
-+ <string>b</string>
-+ </entry>
-+ </map>
-+ <map>
-+ <entry>
-+ <string>c</string>
-+ <string>d</string>
-+ </entry>
-+ </map>
-+ </entry>
-+ <entry>
-+ <map reference="../../entry[2]/map[2]"/>
-+ <map reference="../../entry[2]/map"/>
-+ </entry>
-+ </map>
-+ <map>
-+ <entry>
-+ <string>c</string>
-+ <string>d</string>
-+ </entry>
-+ <entry>
-+ <map reference="../../../entry[2]/map"/>
-+ <map reference="../../../entry[2]/map[2]"/>
-+ </entry>
-+ <entry>
-+ <map reference="../../../entry[2]/map[2]"/>
-+ <map reference="../../../entry[2]/map"/>
-+ </entry>
-+ </map>
-+ </entry>
-+ <entry>
-+ <map reference="../../entry[2]/map[2]"/>
-+ <map reference="../../entry[2]/map"/>
-+ </entry>
-+ </map>
-+ <map>
-+ <entry>
-+ <string>c</string>
-+ <string>d</string>
-+ </entry>
-+ <entry>
-+ <map reference="../../../entry[2]/map"/>
-+ <map reference="../../../entry[2]/map[2]"/>
-+ </entry>
-+ <entry>
-+ <map reference="../../../entry[2]/map[2]"/>
-+ <map reference="../../../entry[2]/map"/>
-+ </entry>
-+ </map>
-+ </entry>
-+ <entry>
-+ <map reference="../../entry[2]/map[2]"/>
-+ <map reference="../../entry[2]/map"/>
-+ </entry>
-+</map>
-+
XStream xstream = new XStream();
-+xstream.fromXML(xml);
-+
Impact
-+
-+ Workarounds
-+
-+ XStream xstream = new XStream();
-+xstream.setMode(XStream.NO_REFERENCES);
-+
XStream xstream = new XStream();
-+xstream.denyTypes(new Class[]{
-+ java.util.HashMap.class, java.util.HashSet.class, java.util.Hashtable.class, java.util.LinkedHashMap.class, java.util.LinkedHashSet.class
-+});
-+
xstream.addDefaultImplementation(java.util.TreeMap.class, java.util.Map.class);
-+xstream.addDefaultImplementation(java.util.TreeSet.class, java.util.Set.class);
-+
Credits
-+
-+
Note: XStream supports other data formats than XML, e.g. JSON. Those formats can be used for -- the same attacks.
-+Note: XStream supports other data formats than XML, e.g. JSON. Those formats can usually be used -+ for the same attacks.
- --Note, that the XML data can be manipulated on different levels. For example, manipulating values on existing -- objects (such as a price value), accessing private data, or breaking the format and causing the XML parser to fail. -- The latter case will raise an exception, but the former case must be handled by validity checks in any application -- which processes user-supplied XML.
-+The XML data can be manipulated on different levels. For example, manipulating values on existing objects (such -+ as a price value), accessing private data, or breaking the format and causing the XML parser to fail. The latter -+ case will raise an exception, but the former case must be handled by validity checks in any application which -+ processes user-supplied XML.
- -XStream supports references to objects already occuring on the object graph in an earlier location. This allows -+ an attacker to create a highly recursive object structure. Some collections or maps calculate the position of a -+ member based on the data of the member itself. This is true for sorting collections or maps, but also for -+ collections or maps based on the hash code of the individual members. The calculation time for the member's -+ position can increase exponentially depending on the recursive depth of the structure and cause therefore a Denial -+ of Service. Therefore XStream measures the time consumed to add an element to a collection or map since version -+ 1.4.19. Normally this operation is performed in a view milliseconds, but if adding elements take longer than a -+ second, then the time is accumulated and an exception is thrown if it exceeds a definable limit (20 seconds by -+ default).
-+ -Starting with XStream 1.4.7, it is possible to define permissions for types, to check -@@ -285,6 +303,16 @@
Apart from value manipulations, this implementation still allows the injection of allowed - objects at wrong locations, e.g. inserting an integer into a list of strings.
- -+To avoid an attack based on the position of an element in a collection or map, you should also use XStream's -+ default converters for 3rd party or own implementations of collections or maps. Own custom converters of such -+ types should measure the time to add an element at deserialization time using the following sequence in the -+ implementation of the unmarshal method:
// unmarshal element of collection -+long now = System.currentTimeMillis(); -+// add element here, e.g. list.add(element); -+SecurityUtils.checkForCollectionDoSAttack(context, now); -+
XML itself supports input validation using a schema and a validating parser. With XStream, you can use e.g. a
-diff --git a/xstream-distribution/src/content/website.xml b/xstream-distribution/src/content/website.xml
-index 157baeb9..ad85d03d 100644
---- a/xstream-distribution/src/content/website.xml
-+++ b/xstream-distribution/src/content/website.xml
-@@ -89,6 +89,7 @@
- 4RlXQrx%1jbAI1mw*0gxmhl6YVOI}}@~pkz8=)x~wB?e#60n5~si7U{5c
z@VCB@HZ822?AN}XrwPi7DB10vu@U8WhYCJz@AoUB^{v`ZhibArYZwr@D%!Z(#!nM8
z`OLh@EQq>F3J5<30BkkW%wkaDJrC0oK#}loSFrV9k}eRObV^tX1mD+o0~m?azkQC<
zLzL_^a_%wlyi$(7fdkR@+$73Tzd+f<<80|n>1O`M?2u2LpP#I@01|sjB4LzSV8HfP
z*19mYKiotyCd^jXWN4Os7N6Rwja*p$z+M}6?)Y^HUR{*G;OabA<2(Lz0q)+t(ln;*
z#@5=;eF&R;1}1aeJb>|TDL~r+8rD)fYY-zxcL?O3?y;3P2%~}Ak~FRtI~6@@wk(Zs
z08;cvA?*1(Vhv^u195m T
z|M;?6^!Py4VE==8mP3;|55j_g^br5wA(|Y+e-O=-wvNjN2bOQMFJyVBJc~&}g16K;
zO@`A2TODW24>h-QpLKsp$sjpYIuLDT;BSr#h(6gw3&r*tc1A03%&VbDRPrk)nrGl!
zK;D47YTdkZiuTjd0X_bMCv?XPpXsr5t$=$9Ji2}QPsxVuxqC{_&!`#S*c=~Eq?0xY
zg>|4wq2jHvT%iJr4G_GC2LJV=S^I`Na><*a3KMUJf0{+y0>2~}^-Z2^cEhOWcK|MX
z6MQvfB6mX>TjkCzeXbC`{)7~T91WWKQTQwq1CA{>r>tDrtV-(Qq|O9}8~eCd}~e
ziE%JGR#}uvit_-4@Ift*l?;2)6vy#Xf*hFFq^B%Sh8y8+JWg#$j5QefCeqPpOT#K8
zsUS!NZ)3E*a~zj_-+ACEX4)`TKI9q-*;hKS%7n?+hwa`pZ*J^bj^$C}&Jv}IPbp@P
z)h(}DU%=_kC@wOsOkZ-{;nqu>m-tF2n(Zbrg0A+j!;`?|oio2s^?)PJ?Hm(Lc@;3v
zpE&kjUFV$;eq|{Oto3Zxf9GI>oYBg1GC6B#FZ6BwhU7T_18vmMXmF`+E>Gq@bzsS5
zeTZvLsF0%rYgU;c#oQ^@k~_JP#D;rW0@Q2)fQ2cZ6e|2)Y@6$wxl
z{<%FU^b^RVkm0X|J!kkW
H^0x6q_tnoYZ%M
zEMKaw{rD;(j%j*8FA|G{<>Lq-b3uwoq%@ktOG_3`d1Z}SjEyp9j9pjoGq1=Ij|&%r
zbRS#dM9S;WD*hn&_Ys)Pu$0olr!jH3pf4UW6>CHnQ7S*1VXBCPPNq1WGb1>_6;(DCqY1OQeNunK-MzZJEv%vv|LmCHSO-?xCg
znwpVW3})yN^yx4NbMSKxKo&dSSPBC)kc(@|lTyIkZu+x-RWy0;`&0psH>?TR<=MRn
zOjEk0puzc!^%D?VF4jS=I!A@c6B-N{WGq<+O}x~bNPs3hm*$W+Tb|&KFK>2_Q;fKY
zw2SdvOpk)?H4!$XGs&zT6uF@J0g?sGH}N6y 7Szx*
zG|YF9uUHwV=u<+riCssRW;o|v2jqXzSkI%$xQ0dzqEwAR<2f2Guis#zK@fX5)cY
z!Sl{7ptex=!`|UC$A>rb>YA=FPDV#Mj83h3-o={N$H>7xmG7!VCdc7vOgWqMR0<$1DpHXuau+(;jw?y90g_!NlTE7*xkTCs+pZhSL_f
zZ4s4IuA4lFun#GFMzt6dweb73h{_`2rChWqHN^g$O@`nJgfD#xE?TFPIPOQ9nikp5
zr~%MmH4sA@)-*XCsEky|N-y(SyW6T-;4hsRgM=cwmXs(e6O8bATr^+ejA_|#78@n5
z83o3@60pK4)12w^$x0l-fgHb1-
TJfzJr*wvSWGjJAFQ4`PF8N_xU)6s4~ta`uNY|P^9
_a;W$2`k7-edV-|)Sc78kzv%D%+_?^{
z?S^XWcI3chQGRT;?Qz3w$(d2S&?fN!y3u4hPo{d9{@unemuujboqsoYIagcS }**bDQ9xyz;_hIsbUM!{<7O+vTWJAc9!-?F_wt6j$iS&FX3j6
zK9+**yQA?K^Y;hgXURu5SMErW1*sU*ReF3!8d*2P8ox0%X2NOA(T;WYsKP8v&>M(M
zlx1%Rop8OUZrdrkrZ7~#2AM7AtT-o6X$j26OEMI2LO=3~?;>h->22-i0MFIX#w4fk
zjQx6d?ZPF>&O=4)hHAhuK7y*j7cF)E+5FP{b=U!INsGIS!zxOWKg9fU2F$1bihDO%
zx^zzgjr3`Oifadp;iAhe2>M_#M|P9OJZMM)t$03;j6c6qq+D