AGadre146415 (Community Member) asked a question.
Hi,
We are getting issue CWE ID 502 - Deserialization of Untrusted Data in our code. Below is the code which produced this issue.
list<Class1> obj = null;
We are puling string data from database into a string variable strVariable.
obj = (list<Class1>) xstream.fromXML(strVariable);
After the issue is thrown by veracode, we applied following changes,
- Checked that xstream version is > 1.4.6. Current version which we have used is 1.4.11.1
- We added following code for whitelisting
XStream xstream = new XStream();
xstream.addPermission(NoTypePermission.NONE);
xstream.addPermission(NullPermission.NULL);
xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
xstream.allowTypes(new Class<?>[] { Class1.class });
We are still getting the same issue. Would you please suggest if anything is missing? or do we need to mitigate this?
Thanks,
Amit
.png){kind=logo}
Hi @AGadre146415 (Community Member) ,
In the October release of Veracode Static Analysis we added the ability to detect possible Deserialization of Untrusted Data from the XStream library by looking at places in your binary where this API is used to transform XML (or JSON) into an object graph. We look a the input for this API and see if it traces back to an input to your program (like an HTTP Request, but also data from the database or a file as we are unable to differentiate between trusted and untrusted inputs).
The concern with using this powerful API is that if an attacker can control (part of) the input they might be able to use it to achieve side effects like for example Remote Code Execution. For an example Baeldung has an excellent blog post: https://www.baeldung.com/java-xstream-remote-code-execution.
XStream versions > 1.4.7 allow use of whitelisting capabilities (though these are not default!) and you can find more here:
https://x-stream.github.io/security.html .
In your example you appear to use the whitelisting capabilities to allow NULL, primitives and "Class1". Provided that Class1 can be deserialized without side effects this would be a good defence against arbitrary deserialization, but not one that we can currently automatically recognise with Veracode Static Analysis.
I would recommend that you document this control in a mitigation proposal ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and contact your security team to request a review of this proposal. Please feel free to, in your proposal, link to this community post.
Thank you,
Boy Baukema