Critical Command Execution Vulnerability in libxstream-java: CVE-2021-21345
Summary
CVE-2021-21345: XStream is a Java library to serialize objects to XML and back again. Affects libxstream-java across 4 version ranges.
< 1.4.15-2
< 3dd9cc610199802e4f13bd49b02a9f99adaba145
< 7153c74dd0e860d0ca3825cc5a23e976e0242b6e
< a0d4141a00ba5de4afaee160836898b41eb28065
Fixed in 1.4.15-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a popular Java library that facilitates the serialization of objects to XML and vice versa. It is widely used for converting Java objects into XML format and for deserializing XML back into Java objects. The library is known for its flexibility and ease of use, but it has a significant security vulnerability that can be exploited if not properly configured. This vulnerability allows remote attackers to execute commands on the host system by manipulating the input stream, especially if the security framework is not set up with a strict whitelist of allowed types.
Vulnerability Detail
CVE-2021-21345 is a vulnerability in XStream versions prior to 1.4.16 that allows a remote attacker with sufficient rights to execute arbitrary commands on the host system. The vulnerability arises from improper handling of the input stream, which can be exploited if the default blacklist of the security framework is used. Users who have not configured XStream's security framework to limit types are at risk. The CVSS score for this vulnerability is 9.9, indicating a critical severity level.
How To Fix
Minimum fixed version
1.4.15-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing a security framework configuration that uses a whitelist of allowed types instead of relying on the default blacklist. This can help reduce the risk of exploitation until the package can be updated.
Conclusion
CVE-2021-21345 is a critical vulnerability in the libxstream-java package that can lead to remote command execution if not properly mitigated. Users are strongly advised to upgrade to version 1.4.16 or later and to configure their security frameworks appropriately to protect against potential exploits.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-21345 is a vulnerability in the XStream library that allows remote command execution due to improper input stream handling.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2021-21345 is 9.9, indicating a critical level of severity.
If you cannot upgrade immediately, configure the security framework to use a whitelist of allowed types to mitigate the risk.
More information can be found in the official CVE database and security advisories related to XStream.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
