CVE-2021-39141
published 2021-08-23CVE-2021-39141: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute…
PriorityP270high8.5CVSS 3.1
AVNACHPRLUINSCCHIHAH
EXPLOIT
EPSS
16.12%
96.6th percentile
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libxstream-java | < libxstream-java 1.4.18-1 (bookworm) | libxstream-java 1.4.18-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | commerce_guided_search | — | — |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | — | — |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | — | — |
| oracle | communications_cloud_native_core_automated_test_suite | — | — |
| oracle | communications_cloud_native_core_binding_support_function | — | — |
| oracle | communications_cloud_native_core_policy | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | utilities_framework | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlldap://{{interactsh-url}}/#evil
- →Monitor for outbound LDAP connections triggered by the application server after processing XML input — a successful exploit causes the server to perform an LDAP lookup to an attacker-controlled host.
- →HTTP 500 response combined with 'com.thoughtworks.xstream' in the response body and 'application/json' Content-Type header is a strong indicator of a triggered XStream deserialization exploit attempt.
- →The exploit abuses unsafe deserialization of com.sun.xml.internal.ws.client.sei.* classes; alert on XStream XML payloads referencing these class paths. ↗
- →DNS callback observed from the target host after processing a crafted XML payload confirms successful JNDI trigger; correlate with interactsh/OOB DNS hits.
- ·Users who configured XStream's security framework with a whitelist limited to the minimal required types are NOT affected by this vulnerability. ↗
- ·XStream 1.4.18 removed the blacklist as the default security mechanism because it cannot be secured for general-purpose use; detections targeting blacklist bypass patterns may not apply to 1.4.18+. ↗
CVSS provenance
nvdv3.18.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
ghsa8.5HIGH
osv8.8HIGH
vendor_debian8.5HIGH
vendor_redhat8.5HIGH
vendor_ubuntu8.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2023-03-13·CVSS 8.5
CVE-2021-39141 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream.
Lai Han discovered that XStream incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2021-39140)
It was discovered that XStream incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2021-39139, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145,
CVE-2021-39146, CVE-2021-39147
Red Hat
xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*
vendor_redhat·2021-08-22·CVSS 8.5
CVE-2021-39141 [HIGH] CWE-502 xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*
xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the p
Debian
CVE-2021-39141: libxstream-java - XStream is a simple library to serialize objects to XML and back again. In affec...
vendor_debian·2021·CVSS 8.5
CVE-2021-39141 [HIGH] CVE-2021-39141: libxstream-java - XStream is a simple library to serialize objects to XML and back again. In affec...
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Scope: local
bookworm: resolved (fixed in 1.4.18-1)
bullseye: resolved (fixed in 1.4.15-3+deb11u1)
forky: resolved (fixed in 1.4.18-1)
sid: resolved (fixed in 1.4.18-1)
trixie: resolved (fixed in 1.4.18-1)
OSV
libxstream-java vulnerabilities
osv·2023-03-13·CVSS 8.8
CVE-2021-39140 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
Lai Han discovered that XStream incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2021-39140)
It was discovered that XStream incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2021-39139, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145,
CVE-2021-39146, CVE-2021-39147, CVE-2021-39148, CVE-2021-39149,
CVE-2021-39151, CVE-20
GHSA
XStream is vulnerable to an Arbitrary Code Execution attack
ghsa·2021-08-25·CVSS 8.5
CVE-2021-39141 [HIGH] CWE-502 XStream is vulnerable to an Arbitrary Code Execution attack
XStream is vulnerable to an Arbitrary Code Execution attack
### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.
### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39141](https://x-stream.github.io/CVE
OSV
XStream is vulnerable to an Arbitrary Code Execution attack
osv·2021-08-25·CVSS 8.5
CVE-2021-39141 [HIGH] XStream is vulnerable to an Arbitrary Code Execution attack
XStream is vulnerable to an Arbitrary Code Execution attack
### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.
### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39141](https://x-stream.github.io/CVE
OSV
CVE-2021-39141: XStream is a simple library to serialize objects to XML and back again
osv·2021-08-23·CVSS 8.5
CVE-2021-39141 [HIGH] CVE-2021-39141: XStream is a simple library to serialize objects to XML and back again
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
No detection rules found.
Nuclei
XStream 1.4.18 - Remote Code Execution
nuclei·CVSS 8.5
CVE-2021-39141 [HIGH] XStream 1.4.18 - Remote Code Execution
XStream 1.4.18 - Remote Code Execution
XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
Template:
id: CVE-2021-39141
info:
name: XStream 1.4.18 - Remote Code Execution
author: pwnhxl
severity: high
description: |
XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
impact: |
Atta
https://github.com/x-stream/xstream/security/advisories/GHSA-g5w6-mrj7-75h2https://lists.debian.org/debian-lts-announce/2021/09/msg00017.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210923-0003/https://www.debian.org/security/2021/dsa-5004https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://x-stream.github.io/CVE-2021-39141.htmlhttps://github.com/x-stream/xstream/security/advisories/GHSA-g5w6-mrj7-75h2https://lists.debian.org/debian-lts-announce/2021/09/msg00017.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210923-0003/https://www.debian.org/security/2021/dsa-5004https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://x-stream.github.io/CVE-2021-39141.html
2021-08-23
Published