Deserialisierung von nicht vertrauenswürdigen Daten und Code-Injektion in xstream

The impact of CVE-2019-10173 is severe. Successful exploitation allows an attacker to execute arbitrary code on the target system with the privileges of the Java process running XStream. This could lead to complete system compromise, data exfiltration, and further lateral movement within the network. The vulnerability stems from a failure to properly initialize the security framework during deserialization, enabling malicious XML or JSON payloads to trigger code execution. This is similar in concept to the earlier CVE-2013-7285, highlighting the ongoing risk of insecure deserialization vulnerabilities.

Applications that utilize XStream for XML or JSON processing, particularly those handling untrusted input, are at risk. This includes web applications, enterprise Java applications, and any system where XStream is used to parse external data. Legacy applications using older XStream versions are particularly vulnerable.

• java / server:

find / -name "xstream-1.4.10.jar" 2>/dev/null

• java / supply-chain: Check dependencies for XStream versions <= 1.4.10-java7 using Maven or Gradle dependency analysis tools. • java / server: Monitor application logs for deserialization errors or suspicious activity related to XML/JSON processing. • generic web: Examine web application request/response logs for XML/JSON payloads that might be attempting to exploit deserialization vulnerabilities.

1. 2019-07-26Disclosure

   disclosure

1. Reserviert2019-03-27
2. Veröffentlicht2019-07-26
3. Geändert2026-02-25
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2019-10173 is to upgrade to XStream version 1.4.11 or later. If upgrading is not immediately feasible, consider implementing input validation and sanitization to prevent the processing of untrusted XML or JSON data. Web application firewalls (WAFs) configured to inspect and block malicious deserialization attempts can provide an additional layer of defense. Monitor application logs for suspicious deserialization activity, particularly errors related to class loading or unexpected object creation.