diff --git a/xstream-distribution/src/content/CVE-2022-40151.html b/xstream-distribution/src/content/CVE-2022-40151.html new file mode 100644 index 000000000..5fd80e5b6 --- /dev/null +++ b/xstream-distribution/src/content/CVE-2022-40151.html @@ -0,0 +1,67 @@ + + + + CVE-2022-40151 + + + +

Vulnerability

+ +

CVE-2022-40151: XStream is vulnerable to a Denial of Service attack due to stack overflow.

+ +

Affected Versions

+ +

All versions until and including version 1.4.19 are affected, if using the version out of the box.

+ +

Description

+ +

The processed stream at unmarshalling time contains type information to recreate the formerly written objects. + XStream creates therefore new instances based on these type information. An attacker can manipulate the processed + input stream and replace or inject objects, that result in a stack overflow due to deeply nested objects causing a + denial of service.

+ +

Steps to Reproduce

+ +

Create a simple HashSet and use XStream to marshal it to XML. Replace the XML with generated with the + following code snippet and unmarshal it with XStream:

+
String xml = new String();
+        int i = 0;
+        for( ; i < 10000; ++i) {
+            xml += "";
+        }
+        for( ; i > 0; --i) {
+            xml += "";
+        }
+
+
XStream xstream = new XStream();
+xstream.fromXML(xml);
+
+ +

As soon as the XML gets unmarshalled, the recursion is too deep and the executing thread is aborted with a stack + overflow error.

+ +

Impact

+ +

The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting + in a denial of service only by manipulating the processed input stream.

+ +

Workarounds

+ +

The only solution is to catch the StackOverflowError in the client code calling XStream.

+ +

Credits

+ +

Henry Lin of the Google OSS-Fuzz team found and reported the issue to XStream and provided the required + information to reproduce it.

+ + + diff --git a/xstream-distribution/src/content/changes.html b/xstream-distribution/src/content/changes.html index 84d606ba8..39c99b27a 100644 --- a/xstream-distribution/src/content/changes.html +++ b/xstream-distribution/src/content/changes.html @@ -33,8 +33,9 @@

Upcoming 1.4.x maintenance release

Not yet released.

-

This maintenance release addresses the security vulnerability - CVE-2022-41966, causing a Denial of Service by raising a stack overflow.

+

This maintenance release addresses the security vulnerabilities + CVE-2022-40151 and CVE-2022-41966, causing a + Denial of Service by raising a stack overflow.

Major changes

diff --git a/xstream-distribution/src/content/security.html b/xstream-distribution/src/content/security.html index 3d233599b..79bd04ba7 100644 --- a/xstream-distribution/src/content/security.html +++ b/xstream-distribution/src/content/security.html @@ -58,6 +58,10 @@

Documented Vulnerabilities

XStream can cause a Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow. + + CVE-2022-40151 + XStream can cause a Denial of Service by injecting deeply nested objects raising a stack overflow. + Version 1.4.18 diff --git a/xstream-distribution/src/content/website.xml b/xstream-distribution/src/content/website.xml index 3fb2f6583..d89179184 100644 --- a/xstream-distribution/src/content/website.xml +++ b/xstream-distribution/src/content/website.xml @@ -64,6 +64,7 @@
!Vulnerabilities CVE-2022-41966.html + CVE-2022-40151.html CVE-2021-21341.html CVE-2021-21342.html CVE-2021-21343.html diff --git a/xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java b/xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java index 8c625d958..04b7ef6f6 100644 --- a/xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java +++ b/xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java @@ -435,4 +435,22 @@ public void testStackOverflowWithRecursiveHashSet() { assertTrue(e.getMessage().indexOf("Stack Overflow") >= 0); } } + + public void testStackOverflowWithDeeplyNestedStructure() { + final StringBuffer xml = new StringBuffer(); + int i = 0; + for( ; i < 10000; ++i) { + xml.append(""); + } + for( ; i > 0; --i) { + xml.append(""); + } + + try { + xstream.fromXML(xml.toString()); + fail("Thrown " + InputManipulationException.class.getName() + " expected"); + } catch (final InputManipulationException e) { + assertTrue(e.getMessage().indexOf("Stack Overflow") >= 0); + } + } }