s-index/CVE-2021-21341

GitHubRepository PoCJava

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2021-21341Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerized Java application that uses XStream 1.4.15 to unmarshal a crafted XML payload, demonstrating a denial-of-service vulnerability (CVE-2021-21341).

README.md:1-3Dockerfile:1-6

Lab assessment

Vulnerability lab

The README explicitly describes CVE-2021-21341, provides a Docker demo, and includes steps to build and run the environment to observe the vulnerability. The Java source contains a crafted XML payload designed to trigger an endless loop in XStream.

README.md:1-3README.md:7-9src/main/java/main.java:6-35
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

build environmentruntime environment

Uses maven:3.8.1-amazoncorretto-8 base image, copies the project source, builds it with mvn package, and runs the resulting JAR.

Dockerfile:1-6

pom.xml

dependency declarationbuild configuration

Declares a dependency on XStream 1.4.15 and configures the maven-shade-plugin to create an executable JAR with main class 'main'.

pom.xml:10-14pom.xml:24-30

main.java

vulnerability triggerproof-of-concept

Contains a main method that constructs a malicious XML string and deserializes it with a default XStream instance, triggering the CVE-2021-21341 DoS.

src/main/java/main.java:1-37

README.md

documentationexercise instructions

Explains the vulnerability, provides Docker build/run commands, shows expected output, and suggests remediation steps.

README.md:1-69
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-21341

Supported by supplied evidence

The README states the vulnerability affects XStream up to 1.4.15, and the pom.xml declares version 1.4.15. The Java code uses a default XStream instance to unmarshal a crafted XML payload that manipulates a ByteArrayInputStream, matching the CVE description of an endless loop causing DoS.

README.md:7-9pom.xml:12-14src/main/java/main.java:6-35
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:25-27
  • The Docker build context must include the pom.xml and src directory.Dockerfile:4

Evidence-described exercise path

  1. Build the Docker image using 'docker build -t cve-2021-21341 .'README.md:25-27
  2. Run the container with 'docker run -it --rm cve-2021-21341' to execute the JAR and observe the endless loop.README.md:29-31
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment only builds and runs a Java application that triggers a DoS within the container. There are no instructions or visible behaviors that escape the container, access the host, connect to external systems, persist data, steal credentials, or perform any destructive actions. The Dockerfile does not use privileged mode or mount sensitive host paths.

Dockerfile:1-6src/main/java/main.java:1-37
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1