CVE-2021-21349
published 2021-03-23CVE-2021-21349: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote…
PriorityP267high8.6CVSS 3.1
AVNACLPRNUINSCCHINAN
EPSS
46.83%
98.7th percentile
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Affected
43 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | < 5.15.14 | 5.15.14 |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | jmeter | < 5.5 | 5.5 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libxstream-java | < libxstream-java 1.4.15-2 (bookworm) | libxstream-java 1.4.15-2 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| oracle | banking_enterprise_default_management | — | — |
| oracle | banking_enterprise_default_management | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_virtual_account_management | — | — |
| oracle | banking_virtual_account_management | — | — |
| oracle | banking_virtual_account_management | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | — | — |
| oracle | communications_policy_management | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2021-21349 is an SSRF vulnerability triggered during XStream XML deserialization (unmarshalling). Detect suspicious XML payloads containing URL-referencing constructs (e.g., java.net.URL or sun.net.www types) passed to XStream's fromXML() or similar entry points. ↗
- →Monitor outbound HTTP/HTTPS/FTP connections originating from the JVM process handling XStream deserialization, particularly to internal/intranet IP ranges (RFC-1918) or localhost (127.0.0.1), as these indicate successful SSRF exploitation. ↗
- →Applications using XStream versions prior to 1.4.16 without a whitelist-based security framework are vulnerable. Identify and flag any deployment of XStream < 1.4.16 in your environment. ↗
- →If relying on XStream's default blacklist (rather than a whitelist), the application remains exploitable. Audit XStream security framework configuration to confirm whitelist enforcement is in place. ↗
- ·Users who configured XStream's security framework with a whitelist limited to the minimal required types are NOT affected by this vulnerability, regardless of XStream version. ↗
- ·OpenShift Container Platform Jenkins packages are NOT affected due to JEP-200 and JEP-228 protections applied to the bundled XStream library. ↗
- ·Debian resolved this CVE in package version 1.4.15-2 (not 1.4.16 upstream), meaning the Debian fix is a backport — version string alone may not be a reliable indicator on Debian-based systems. ↗
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
ghsa8.6HIGH
osv8.8HIGH
vendor_ubuntu8.0HIGH
vendor_debian6.1MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
libxstream-java vulnerabilities
osv·2024-08-22·CVSS 7.5
CVE-2016-3674 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
It was discovered that XStream incorrectly handled parsing of certain
crafted XML documents. A remote attacker could possibly use this issue to
read arbitrary files. (CVE-2016-3674)
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery
attacks. A remote attacker could request data from internal resources
that are not publicly available only by manipulating the processed input
stream. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion
on the local host. A remote attacker could use this to delete arbitrary
kn
OSV
libxstream-java vulnerabilities
osv·2021-05-11·CVSS 8.8
CVE-2020-26217 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. This issue affected only affected
Ubuntu 20.10. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream. This
issue only affected Ubuntu 20.10. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulatin
OSV
CVE-2021-21349: XStream is a Java library to serialize objects to XML and back again
osv·2021-03-23·CVSS 8.6
CVE-2021-21349 [HIGH] CVE-2021-21349: XStream is a Java library to serialize objects to XML and back again
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
GHSA
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
ghsa·2021-03-22·CVSS 8.6
CVE-2021-21349 [HIGH] CWE-502 A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.
### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions c
OSV
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
osv·2021-03-22·CVSS 8.6
CVE-2021-21349 [HIGH] A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.
### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions c
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2024-08-22·CVSS 7.5
CVE-2021-21342 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream.
It was discovered that XStream incorrectly handled parsing of certain
crafted XML documents. A remote attacker could possibly use this issue to
read arbitrary files. (CVE-2016-3674)
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery
attacks. A remote attacker could request data from internal resources
that are not publicly available only by manipulating the processed input
stream. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion
on the local host.
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2021-05-11·CVSS 8.0
CVE-2020-26258 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream library.
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. This issue affected only affected
Ubuntu 20.10. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream. This
issue only affected Ubuntu 20.10. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as
Red Hat
XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
vendor_redhat·2021-03-12·CVSS 6.1
CVE-2021-21349 [MEDIUM] CWE-918 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Statement: OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStr
Debian
CVE-2021-21349: libxstream-java - XStream is a Java library to serialize objects to XML and back again. In XStream...
vendor_debian·2021·CVSS 6.1
CVE-2021-21349 [MEDIUM] CVE-2021-21349: libxstream-java - XStream is a Java library to serialize objects to XML and back again. In XStream...
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Scope: local
bookworm: resolved (fixed in 1.4.15-2)
bullseye: resolved (fixed in 1.4.15-2)
forky: resolved (fixed in 1.4.15-2)
sid: resolved (fixed in 1.4.15-2)
trixie: resolved (fixed in 1.4.15-2)
No detection rules found.
No public exploits indexed.
http://x-stream.github.io/changes.html#1.4.16https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjvhttps://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2021/04/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210430-0002/https://www.debian.org/security/2021/dsa-5004https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://x-stream.github.io/CVE-2021-21349.htmlhttps://x-stream.github.io/security.html#workaroundhttp://x-stream.github.io/changes.html#1.4.16https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjvhttps://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2021/04/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210430-0002/https://www.debian.org/security/2021/dsa-5004https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://x-stream.github.io/CVE-2021-21349.htmlhttps://x-stream.github.io/security.html#workaround
2021-03-23
Published