CVE-2021-29505
published 2021-05-28CVE-2021-29505: XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has…
PriorityP181high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
77.73%
99.5th percentile
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libxstream-java | < libxstream-java 1.4.15-3 (bookworm) | libxstream-java 1.4.15-3 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| oracle | banking_cash_management | — | — |
| oracle | banking_cash_management | — | — |
| oracle | banking_cash_management | — | — |
| oracle | banking_corporate_lending_process_management | — | — |
| oracle | banking_corporate_lending_process_management | — | — |
| oracle | banking_corporate_lending_process_management | — | — |
| oracle | banking_credit_facilities_process_management | — | — |
| oracle | banking_credit_facilities_process_management | — | — |
| oracle | banking_credit_facilities_process_management | — | — |
| oracle | banking_supply_chain_finance | — | — |
| oracle | banking_trade_finance_process_management | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | communications_brm_elastic_charging_engine | — | — |
| oracle | communications_brm_elastic_charging_engine | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
Detection & IOCsextracted from sources · hover to see the quote
othercom.sun.xml.internal.ws.api.message.Packet
otherUnicastRef
port1099
sigma
matchers-condition: and matchers: - type: word part: interactsh_protocol words: - "dns" - type: word part: body words: - "timestamp" - "com.thoughtworks.xstream" condition: or - type: word part: header words: - "application/json" - type: status status: - 500
- →Exploit payload uses a SOAP_11 envelope containing a com.sun.xml.internal.ws.api.message.Packet object with an embedded UnicastRef element pointing to an attacker-controlled RMI host on port 1099 — detect XML deserialization requests containing these class references.
- →Exploit triggers an outbound DNS callback to an interactsh/OOB interaction server; monitor for unexpected DNS lookups originating from Java application servers processing XStream-deserialized XML.
- →A successful exploit attempt against a vulnerable endpoint returns HTTP 500 with 'com.thoughtworks.xstream' in the response body and Content-Type application/json — use these as detection signals.
- →Deny-list regex for XStream 1.4.16 to block RMI-based exploitation: block types matching '(?:java|sun)\.rmi\..*' in the deserialization pipeline. ↗
- ·Only users who did NOT configure XStream's security framework with a whitelist of minimal required types are affected; whitelisted deployments are not vulnerable. ↗
- ·OpenShift Container Platform Jenkins packages are not affected due to JEP-200 and JEP-228 protections already in place. ↗
- ·CodeReady Studio 12 includes an affected XStream version as a transitive dependency for the Wise framework plugin, but the vulnerable code path is not invoked — rated Low severity for that product. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
ghsa8.8HIGH
osv8.8HIGH
vendor_oracle8.8HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Retail Applications Risk Matrix: Other (XStream) — CVE-2021-29505
vendor_oracle·2022-07-15·CVSS 8.8
CVE-2021-29505 [HIGH] Oracle Oracle Retail Applications Risk Matrix: Other (XStream) — CVE-2021-29505
Oracle Oracle Retail Applications Risk Matrix: Other (XStream) vulnerability
CVE: CVE-2021-29505
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Rulesets (XStream) — CVE-2021-29505
vendor_oracle·2022-01-15·CVSS 8.8
CVE-2021-29505 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Rulesets (XStream) — CVE-2021-29505
Oracle Oracle Communications Applications Risk Matrix: Rulesets (XStream) vulnerability
CVE: CVE-2021-29505
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Guest Management (XStream) — CVE-2021-29505
vendor_oracle·2021-10-15·CVSS 8.8
CVE-2021-29505 [HIGH] Oracle Oracle Enterprise Manager Risk Matrix: Guest Management (XStream) — CVE-2021-29505
Oracle Oracle Enterprise Manager Risk Matrix: Guest Management (XStream) vulnerability
CVE: CVE-2021-29505
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2021 (OCT 2021)
Red Hat
XStream: remote command execution attack by manipulating the processed input stream
vendor_redhat·2021-05-14·CVSS 7.5
CVE-2021-29505 [HIGH] CWE-502 XStream: remote command execution attack by manipulating the processed input stream
XStream: remote command execution attack by manipulating the processed input stream
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availabilit
Debian
CVE-2021-29505: libxstream-java - XStream is software for serializing Java objects to XML and back again. A vulner...
vendor_debian·2021·CVSS 7.5
CVE-2021-29505 [HIGH] CVE-2021-29505: libxstream-java - XStream is software for serializing Java objects to XML and back again. A vulner...
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
Scope: local
bookworm: resolved (fixed in 1.4.15-3)
bullseye: resolved (fixed in 1.4.15-3)
forky: resolved (fixed in 1.4.15-3)
sid: resolved (fixed in 1.4.15-3)
trixie: resolved (fixed in 1.4.15-3)
OSV
CVE-2021-29505: XStream is software for serializing Java objects to XML and back again
osv·2021-05-28·CVSS 8.8
CVE-2021-29505 [HIGH] CVE-2021-29505: XStream is software for serializing Java objects to XML and back again
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
GHSA
XStream is vulnerable to a Remote Command Execution attack
ghsa·2021-05-18·CVSS 8.8
CVE-2021-29505 [HIGH] CWE-502 XStream is vulnerable to a Remote Command Execution attack
XStream is vulnerable to a Remote Command Execution attack
### Impact
The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
### Patches
If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.17.
### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.
### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-29505](https://x-stream.
OSV
XStream is vulnerable to a Remote Command Execution attack
osv·2021-05-18·CVSS 8.8
CVE-2021-29505 [HIGH] XStream is vulnerable to a Remote Command Execution attack
XStream is vulnerable to a Remote Command Execution attack
### Impact
The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
### Patches
If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.17.
### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.
### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-29505](https://x-stream.
No detection rules found.
Nuclei
XStream <1.4.17 - Remote Code Execution
nuclei·CVSS 8.8
CVE-2021-29505 [HIGH] XStream <1.4.17 - Remote Code Execution
XStream
2
3
12345
com.sun.xml.internal.ws.api.message.Packet@2002fc1d Content
12345
true
SOAP_11
false
aa
aa
UnicastRef
{{interactsh-url}}
1099
0
0
0
0
false
{{interactsh-url}}
1099
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "dns"
- type: word
part: body
words:
- "timestamp"
- "com.thoughtworks.xstream"
condition: or
- type: word
part: header
words:
- "application/json"
- type: status
status:
- 500
# digest: 4a0a004730450220229a24ac93dffc329e9f52106209b094e89caaf0fb478c90193f86f9e8e6f43202210091844ee06451f18188790ad34c7e1ca7679fb6e4a89a1e5c44b3eaadee48a09c:922c64590222798bb761d5b6d8e72950
Greynoiseio
NoiseLetter October 2025
blogs_greynoiseio
NoiseLetter October 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bugzilla
CVE-2021-29505 XStream: remote command execution attack by manipulating the processed input stream
bugzilla·2021-06-01·CVSS 8.8
CVE-2021-29505 [HIGH] CVE-2021-29505 XStream: remote command execution attack by manipulating the processed input stream
CVE-2021-29505 XStream: remote command execution attack by manipulating the processed input stream
The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
Reference:
https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc
Discussion:
Created xstream tracking bugs for this issue:
Affects: fedora-all [bug 1966736]
---
Marking Red Hat JBoss Fuse 6, Red Hat Fuse 7 and Red Hat Intergration Camel K as Moderate, although these products use vulnerable versions of XStream through the camel-xstream component https://access.redhat.com/doc
https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624fhttps://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fchttps://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f@%3Cdev.jmeter.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2021/07/msg00004.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHPhttps://lists.fedoraproject.org/archives/list/[email protected]/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7https://lists.fedoraproject.org/archives/list/[email protected]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREBhttps://security.netapp.com/advisory/ntap-20210708-0007https://www.debian.org/security/2021/dsa-5004https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://x-stream.github.io/CVE-2021-29505.htmlhttps://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624fhttps://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fchttps://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f%40%3Cdev.jmeter.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2021/07/msg00004.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210708-0007/https://www.debian.org/security/2021/dsa-5004https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2021-05-28
Published