XStream · XStream
XStream, a Java library for serializing objects to XML and back, contains a remote code execution flaw in its deserialization handling, which in affected versions lets input streams be manipulated to run commands on the host. An attacker needs sufficient rights and must be able to supply crafted input to the processing stream over the network, with the attack complexity being high, while deployments that configured XStream's security framework with a whitelist of only the minimal required types are not affected.
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
First seen exploited 18 months after disclosure. Public exploit code (Metasploit) appeared 14 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
The vulnerability allows a remote attacker to execute arbitrary code on the target system. It exists due to the deserialization of untrusted data in XStream versions up to 1.4.18. A remote attacker can exploit this by sending a specially crafted XStream marshalled payload to an endpoint in VMware NSX Manager, which uses the vulnerable xstream-1.4.18.jar package. Successful exploitation of this vulnerability may result in complete compromise of the vulnerable system, allowing execution of commands with root privileges.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: com.thoughtworks.xstream:xstream.
Upgrade to 1.4.18 or later
Fixes this CVE and 12 other known vulnerabilities in this package (CVE-2013-7285, CVE-2019-10173, +10).
Set the version to 1.4.18 or later in your pom.xml or build.gradle.
The first fix for CVE-2021-39144.
| If you run | Upgrade to |
|---|---|
| All versions before 1.4.18 | 1.4.18 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.