CVE-2021-39144highunder attackCWE-502CWE-94

CVE-2021-39144: high-severity vulnerability in x-stream xstream

XStream is vulnerable to a Remote Command Execution attack

Published · Updated

Follow this CVE+ Monitor xstream+ Monitor libxstream-java

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.5epss 98%
from disclosure to weapon428 days
Published on NVDAug 23
metasploit+428d
CISA KEV+564d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
9 products
Red Hat BPM Suite 6 · Red Hat Integration Camel Quarkus 1 · Red Hat JBoss A-MQ 6 · Red Hat JBoss BRMS 5 · Red Hat JBoss BRMS 6 · and others 4
no_fix_planned: Out of support scope
Fixed
11 products (19 components)
Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux ComputeNode Optional (v. 7) · Red Hat Enterprise Linux Server Optional (v. 7) · Red Hat Enterprise Linux Workstation Optional (v. 7) · RHDM 7.12.0 · and others 6
fix ↗
Not affected
17 products (19 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 3.11 · Red Hat OpenShift Container Platform 4 · A-MQ Clients 2 · Logging Subsystem for Red Hat OpenShift · Migration Toolkit for Applications 6 · and others 12
Action required by CISAfederal deadline: 2023-03-31

Apply updates per vendor instructions.

In short

XStream, a library that converts objects to XML, can be exploited by attackers to run arbitrary commands on a server if the input data is manipulated. This happens because the library deserializes untrusted data without proper restrictions.

Technical detail

Remote code execution vulnerability in XStream's deserialization process (CWE-502, CWE-94) allowing unauthenticated attackers to execute arbitrary system commands by crafting malicious XML input. Exploitation requires processing untrusted serialized data; mitigation requires implementing XStream's security whitelist framework or upgrading to version 1.4.18+, which defaults to a secure configuration instead of a blacklist approach.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
x-stream · xstream
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — x-stream xstream

In the same product, most dangerous first.

CVE-2020-26217HIGHRemote Code Execution in XStreamEPSS 85.0%CVE-2020-26259MEDIUMXStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshallingEPSS 82.4%CVE-2021-21351MEDIUMXStream is vulnerable to an Arbitrary Code Execution attackEPSS 82.1%CVE-2020-26258MEDIUMServer-Side Forgery Request can be activated unmarshalling with XStreamEPSS 81.8%CVE-2021-21341HIGHXStream can cause a Denial of ServiceEPSS 77.8%CVE-2021-29505HIGHXStream is vulnerable to a Remote Command Execution attackEPSS 77.2%