Liaogui Zhong

The issue allows a remote attacker to delete arbitrary files on the host as long as the executing process has sufficient rights, by manipulating the processed input stream. This can be done when unmarshalling, exploiting the lack of proper security measures in the XStream library. No user is affected if they have set up XStream's Security Framework with a whitelist. The vulnerability does not exist when running Java 15 or higher.

The issue is related to a Server-Side Forgery Request vulnerability in XStream, a Java library used to serialize objects to XML and back again. This vulnerability can be activated when unmarshalling and may allow a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream. The vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist.