CVE-2021-39152: Server-Side Forgery Request in com.thoughtworks.xstream:xstream
Summary
CVE-2021-39152: Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. Affects com.thoughtworks.xstream:xstream versions < 1.4.18. Fixed in 1.4.18. How to fix ↓
Also tracked for
- libxstream-java · Debian:11
The same CVE-2021-39152 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.thoughtworks.xstream:xstream is an open-source library that provides a simple way to serialize objects to XML and back again. It is widely used in Java applications for data serialization and deserialization. However, a vulnerability has been discovered in versions prior to 1.4.18 that allows a remote attacker to activate a Server-Side Forgery Request by manipulating the processed input stream with a Java runtime version 14 to 8. This can lead to unauthorized access to internal resources that are not publicly available.
Vulnerability Detail
The vulnerability in com.thoughtworks.xstream:xstream allows an attacker to request data from internal resources by exploiting the unmarshalling process with XStream. By referencing a resource in an intranet or the local host, an attacker can manipulate the input stream and gain access to sensitive information. This vulnerability affects Java runtime versions 14 to 8. Users who have not implemented XStream's security framework with a whitelist limited to the minimal required types are at risk. The impact of this vulnerability can be significant, as it allows unauthorized access to internal resources.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to version 1.4.18 is not immediately feasible, a workaround can be implemented. The XStream documentation provides detailed instructions on how to apply workarounds for different versions covering all CVEs. It is recommended to follow these workarounds until the library can be updated to a secure version. The XStream documentation can be found at: XStream Security Workarounds
Conclusion
The vulnerability in com.thoughtworks.xstream:xstream can lead to unauthorized access to internal resources. To mitigate this risk, it is crucial to update the library to version 1.4.18 or later. Alternatively, users can apply the provided workarounds until the library can be updated. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
com.thoughtworks.xstream:xstream is an open-source library for serializing and deserializing objects to XML. It is commonly used in Java applications for data conversion.
The vulnerability allows a remote attacker to request data from internal resources that are not publicly available. This can lead to unauthorized access to sensitive information.
The vulnerability was found and reported by m0d9 of the Security Team of Alibaba Cloud. They provided the necessary information to reproduce the issue.
To fix this vulnerability, it is recommended to update com.thoughtworks.xstream:xstream to version 1.4.18 or later. This version includes patches that address the vulnerability.
No, only versions prior to 1.4.18 are affected by this vulnerability. It is important to update to the latest secure version.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
