CVE-2021-39144
published 2021-08-23CVE-2021-39144: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient…
PriorityP193high8.5CVSS 3.1
AVNACHPRLUINSCCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2023-03-31
Exploited in the wild
EPSS
98.12%
99.9th percentile
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libxstream-java | < libxstream-java 1.4.18-1 (bookworm) | libxstream-java 1.4.18-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | commerce_guided_search | — | — |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | — | — |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | — | — |
| oracle | communications_cloud_native_core_automated_test_suite | — | — |
| oracle | communications_cloud_native_core_binding_support_function | — | — |
| oracle | communications_cloud_native_core_policy | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | utilities_framework | — | — |
Detection & IOCsextracted from sources · hover to see the quote
yara
id: CVE-2021-39144 — Nuclei template matching POST / with XML body containing java.lang.Runtime/exec gadget chain and interactsh callback
sigma
shodan-query: title:"VMware Appliance Management"
- →Monitor for unauthenticated HTTP PUT requests to the NSX-V endpoint path /api/2.0/services/usermgmt/password/ — this is the vulnerable unauthenticated endpoint exploited for RCE as root. ↗
- →Detect inbound XML payloads referencing Java gadget chain classes such as java.lang.Runtime, java.lang.Comparable, and compareTo method invocations in Content-Type: application/xml requests to NSX-V endpoints.
- →Alert on HTTP responses with status 400 and body containing 'deceptive request routing' from VMware NSX Manager, which is the expected server response during exploitation attempts.
- →Hunt for VMware NSX Manager appliances exposed to the internet using the Shodan/FOFA query for 'VMware Appliance Management' title, as these are directly exploitable targets.
- →Identify vulnerable VMware Cloud Foundation NSX-V instances: versions 3.x and NSX Manager Data Center for vSphere up to and including version 6.4.13 are affected. ↗
- →A public proof-of-concept exploit script providing a reverse shell on vulnerable VMware Cloud Foundation NSX-V instances was published on the Source Incite blog; monitor for exploitation traffic matching this PoC. ↗
- ·Installations that configured XStream's security framework with an allow-list (whitelist) of minimal required types are NOT vulnerable to this CVE. ↗
CVSS provenance
nvdv3.18.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
ghsa8.5HIGH
osv8.8HIGH
vulncheck8.5HIGH
cisa8.5HIGH
vendor_debian8.5HIGH
vendor_redhat8.5HIGH
vendor_ubuntu8.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2023-03-13·CVSS 8.5
CVE-2021-39141 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream.
Lai Han discovered that XStream incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2021-39140)
It was discovered that XStream incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2021-39139, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145,
CVE-2021-39146, CVE-2021-39147
CISA
XStream Remote Code Execution Vulnerability
cisa·2023-03-10·CVSS 8.5
CVE-2021-39144 [HIGH] CWE-94 XStream Remote Code Execution Vulnerability
Vulnerability: XStream Remote Code Execution Vulnerability
Affected: XStream XStream
XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.
Required Action: Apply updates per vendor instructions.
Notes: https://www.vmware.com/security/advisories/VMSA-2022-0027.html, https://x-stream.github.io/CVE-2021-39144.html; https://nvd.nist.gov/vuln/detail/CVE-2021-39144
Remediation Due Date: 2023-03-31
VMware
VMware Cloud Foundation updates address multiple vulnerabilities.
vendor_vmware·2022-10-25·CVSS 8.5
CVE-2021-39144 [HIGH] VMware Cloud Foundation updates address multiple vulnerabilities.
VMSA-2022-0027: VMware Cloud Foundation updates address multiple vulnerabilities.
VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
CVEs: CVE-2021-39144, CVE-2022-31678
Affected products: VMware Cloud Foundation
Red Hat
xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*
vendor_redhat·2021-08-22·CVSS 8.5
CVE-2021-39144 [HIGH] CWE-502 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*
xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream.
Debian
CVE-2021-39144: libxstream-java - XStream is a simple library to serialize objects to XML and back again. In affec...
vendor_debian·2021·CVSS 8.5
CVE-2021-39144 [HIGH] CVE-2021-39144: libxstream-java - XStream is a simple library to serialize objects to XML and back again. In affec...
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Scope: local
bookworm: resolved (fixed in 1.4.18-1)
bullseye: resolved (fixed in 1.4.15-3+deb11u1)
forky: resolved (fixed in 1.4.18-1)
sid: resolved (fixed in 1.4.18-1)
trixie: resolved (fixed in 1.4.18-1)
OSV
libxstream-java vulnerabilities
osv·2023-03-13·CVSS 8.8
CVE-2021-39140 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
Lai Han discovered that XStream incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2021-39140)
It was discovered that XStream incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2021-39139, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145,
CVE-2021-39146, CVE-2021-39147, CVE-2021-39148, CVE-2021-39149,
CVE-2021-39151, CVE-20
OSV
XStream is vulnerable to a Remote Command Execution attack
osv·2021-08-25·CVSS 8.5
CVE-2021-39144 [HIGH] XStream is vulnerable to a Remote Command Execution attack
XStream is vulnerable to a Remote Command Execution attack
### Impact
The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.
### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39144](https://x-stream.github.io/CVE-
GHSA
XStream is vulnerable to a Remote Command Execution attack
ghsa·2021-08-25·CVSS 8.5
CVE-2021-39144 [HIGH] CWE-306 XStream is vulnerable to a Remote Command Execution attack
XStream is vulnerable to a Remote Command Execution attack
### Impact
The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.
### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39144](https://x-stream.github.io/CVE-
OSV
CVE-2021-39144: XStream is a simple library to serialize objects to XML and back again
osv·2021-08-23·CVSS 8.5
CVE-2021-39144 [HIGH] CVE-2021-39144: XStream is a simple library to serialize objects to XML and back again
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
VulnCheck
XStream Remote Code Execution Vulnerability
vulncheck·2021·CVSS 8.5
CVE-2021-39144 [HIGH] CWE-94 XStream Remote Code Execution Vulnerability
XStream Remote Code Execution Vulnerability
XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.
Affected: XStream XStream
Required Action: Apply updates per vendor instructions.
Exploitation References: https://lab.wallarm.com/vmware-nsx-manager-vulnerabilities-being-actively-exploited-in-the-wild/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-31&host_type=src&vulnerability=cve-2021-39144; https://dashb
Suricata
ET EXPLOIT Possible VMWare NSX Manager Remote Code Execution Exploit Attempt (CVE-2021-39144)
suricata·2022-10-28·CVSS 8.5
CVE-2021-39144 [HIGH] ET EXPLOIT Possible VMWare NSX Manager Remote Code Execution Exploit Attempt (CVE-2021-39144)
ET EXPLOIT Possible VMWare NSX Manager Remote Code Execution Exploit Attempt (CVE-2021-39144)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible VMWare NSX Manager Remote Code Execution Exploit Attempt (CVE-2021-39144)"; flow:established,to_server; http.request_line; content:"PUT|20|/api/2.0/services/usermgmt/password/"; startswith; reference:url,srcincite.io/blog/2022/10/25/eat-what-you-kill-pre-authenticated-rce-in-vmware-nsx-manager.html; reference:cve,2021-39144; classtype:attempted-admin; sid:2039596; rev:3; metadata:affected_product VMware, attack_target Server, created_at 2022_10_28, cve CVE_2021_39144, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_
Nuclei
XStream 1.4.18 - Remote Code Execution
nuclei·CVSS 8.5
CVE-2021-39144 [HIGH] XStream 1.4.18 - Remote Code Execution
XStream 1.4.18 - Remote Code Execution
XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. Setups which followed XStream's security recommendations with an allow-list are not impacted.
Template:
id: CVE-2021-39144
info:
name: XStream 1.4.18 - Remote Code Execution
author: pwnhxl,vicrack
severity: high
description: |
XStream 1.4.18 is susceptible to remote code execution. An attacker can execute commands of the host by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and
Metasploit
VMware NSX Manager XStream unauthenticated RCE
metasploit
VMware NSX Manager XStream unauthenticated RCE
VMware NSX Manager XStream unauthenticated RCE
VMware Cloud Foundation (NSX-V) contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V), a malicious actor can get remote code execution in the context of 'root' on the appliance. VMware Cloud Foundation 3.x and more specific NSX Manager Data Center for vSphere up to and including version 6.4.13 are vulnerable to Remote Command Injection. This module exploits the vulnerability to upload and execute payloads gaining root privileges.
Nuclei
VMware NSX Manager XStream Pre-authenticated Remote Code Execution
nuclei
VMware NSX Manager XStream Pre-authenticated Remote Code Execution
VMware NSX Manager XStream Pre-authenticated Remote Code Execution
VMware Cloud Foundation (NSX-V) contains a remote code execution vulnerability via XStream open source library.
VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V),
a malicious actor can get remote code execution in the context of 'root' on the appliance.
VMware Cloud Foundation 3.x and more specific NSX Manager Data Center for vSphere up to and including version 6.4.13
are vulnerable to Remote Command Injection.
Template:
id: vmware-nsx-stream-rce
info:
name: VMware NSX Manager XStream Pre-authenticated Remote Code Execution
author
Checkpoint
31st October – Threat Intelligence Report
blogs_checkpoint·2022-10-31
CVE-2022-3723 31st October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 31st October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 31st October, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
US-based communications company Twilio has disclosed a new data breach that occurred on June 2022 allegedly by the same threat actors behind the August hack. The hackers have used voice phishing to trick a Twilio employee into handling over their credentials, which the hackers then used to access customer information.
Cu
Tenable
CVE-2021-39144: VMware Patches Critical Cloud Foundation Vulnerability in XStream Open Source Library
blogs_tenable·2022-10-26·CVSS 8.5
[HIGH] CVE-2021-39144: VMware Patches Critical Cloud Foundation Vulnerability in XStream Open Source Library
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*
bugzilla·2021-08-25·CVSS 8.5
CVE-2021-39144 [HIGH] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*
CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
References:
https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh
https://x-stream.github.io/CVE-2021-39144.html
Discussion:
Created xstream tracking bugs for this issue:
Affects: fedora-a
http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.htmlhttps://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fhhttps://lists.debian.org/debian-lts-announce/2021/09/msg00017.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210923-0003/https://www.debian.org/security/2021/dsa-5004https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://x-stream.github.io/CVE-2021-39144.htmlhttp://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.htmlhttps://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fhhttps://lists.debian.org/debian-lts-announce/2021/09/msg00017.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210923-0003/https://www.debian.org/security/2021/dsa-5004https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://x-stream.github.io/CVE-2021-39144.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39144
2021-08-23
Published
2023-03-10
Added to CISA KEV
Exploited in the wild