QID 375827

XStream is a simple library to serialize objects to XML and back again.

The processed stream at the unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on this type of information. An attacker can manipulate the processed input stream and replace or inject objects, that can execute arbitrary shell commands

Affected Versions:
XStream library prior and including 1.4.17
XStream library prior and including 1.4.16
XStream library prior and including 1.4.15
XStream library prior and including 1.4.14
XStream library prior and including 1.4.13
XStream library prior and including 1.4.9
XStream library prior and including 1.4.8
XStream library prior and including 1.4.6
XStream library prior and including 1.4.10
QID Detection Logic:
This authenticated QID fetches the version of the XStream library if it is installed via the package manager on Unix based operating systems with commands such as dpkg -l and rpm -qa.

NOTE: This QID will work only if the XStream library is installed as via the package manager.

The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.