CVE-2021-21341

HIGH

XStream can cause a Denial of Service

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-21341 has a selected CVSS score of 7.5 (high); EIP currently links 2 repository PoCs and 2 lab environments.

Description

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2
Lab environments
2

Affected products and versions

2
ProductSourceVersion range

xstream

Browse x-stream / xstream
CVE List< 1.4.16affected

com.thoughtworks.xstream:xstream

Browse Maven / com.thoughtworks.xstream:xstream
GitHub AdvisoryBefore 1.4.16 · Fixed in 1.4.16affected

Proofs of concept

2

Repository PoCs

GitHubs-index/CVE-2021-21341Repository PoCby s-index0Not analyzed4 files

5.6 KiB

GitHub
PoC details
GitHubMani1325/ka-cve-2021-21341Repository PoCby Mani13250Not analyzed11 files

Java · 659.6 KiB

GitHub
PoC details

Docker lab environments

2
GitHub

Repository root

Mani1325/ka-cve-2021-21341Created Vuln labCVE-2021-21341Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile environment that builds and runs a Java application using XStream 1.4.15, a library known to be vulnerable to deserialization attacks. The application deserializes a hardcoded XML payload.

Dockerfile:1-6pom.xml:11-14src/main/java/main.java:1-37

Lab assessment

Vulnerability lab

The README explicitly names CVE-2021-21341, the pom.xml declares a dependency on XStream 1.4.15 (a version affected by that CVE), and the main.java source code constructs and deserializes a malicious XML payload designed to exploit XStream. This is a classic vulnerability reproduction exercise.

README.md:1pom.xml:11-14src/main/java/main.java:1-37
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Maven build container

build environmentdependency resolver

Uses the maven:3.8.1-amazoncorretto-8 image to copy the source tree, run 'mvn package', and produce a shaded JAR. The build process is defined in the Dockerfile and configured by pom.xml.

Dockerfile:1-5pom.xml:1-44

XStream vulnerable application

vulnerable targetdeserialization endpoint

A Java application with a main class that instantiates XStream and calls xstream.fromXML() on a hardcoded XML string. The XML payload references classes like java.util.PriorityQueue and com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data, which are typical of XStream deserialization exploits. The application is packaged as a shaded JAR and executed by the container's CMD.

src/main/java/main.java:1-37Dockerfile:6

Shaded JAR (target/xstream-1.0-SNAPSHOT.jar)

packaged applicationexploit target

The final artifact produced by the Maven shade plugin. It bundles the application code and the XStream dependency. The file is present in the build context but its content is omitted due to size.

Dockerfile:6pom.xml:22-40
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-21341

Supported by supplied evidence

The README explicitly associates the repository with CVE-2021-21341. The pom.xml declares a dependency on XStream 1.4.15, which is a version known to be affected by this CVE (an unsafe deserialization vulnerability). The main.java code demonstrates deserialization of an untrusted XML payload without any security framework or type allowlisting, matching the vulnerability description.

README.md:1pom.xml:11-14src/main/java/main.java:1-37
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build the image from the Dockerfile.Dockerfile:1-6
  • The build context must include the complete source tree (pom.xml, src/, and pre-built target/ directory) as the Dockerfile copies './' into the image.Dockerfile:4
  • The Maven build requires network access to download dependencies (XStream 1.4.15 and plugins) unless they are cached locally.pom.xml:11-14

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile, which copies the source, runs 'mvn package', and sets the CMD to execute the shaded JAR.Dockerfile:1-6
  2. Run a container from the built image. The container will execute 'java -jar target/xstream-1.0-SNAPSHOT.jar', which invokes the main class.Dockerfile:6
  3. The main class deserializes the hardcoded XML payload using XStream, triggering the vulnerability. The expected behavior is a denial of service (e.g., high CPU/memory consumption) or potentially remote code execution depending on the runtime classpath.src/main/java/main.java:1-37
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The exploit payload is hardcoded in the application source and targets only the application's own JVM. There are no network connections, host volume mounts, privilege escalations, or external command executions. The Dockerfile does not expose ports, run as privileged, or copy sensitive host files. The behavior is limited to demonstrating the CVE within the container.

Dockerfile:1-6src/main/java/main.java:1-37
Review boundaries

What the analysis did not establish

  • The oversized JAR (target/xstream-1.0-SNAPSHOT.jar) and two binary class files (target/classes/main.class, target/original-xstream-1.0-SNAPSHOT.jar) are uninspected. Their behavior cannot be confirmed from the supplied text.
  • The Dockerfile does not include a non-root USER instruction; the container runs as root by default, which is a common but not necessarily malicious practice in lab environments.
  • The exact runtime effect of the hardcoded XML payload (denial of service vs. code execution) cannot be determined without executing the code or inspecting the omitted JAR.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted · 2 binary files not inspected

GitHub

Repository root

s-index/CVE-2021-21341Created Vuln labCVE-2021-21341Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerized Java application that uses XStream 1.4.15 to unmarshal a crafted XML payload, demonstrating a denial-of-service vulnerability (CVE-2021-21341).

README.md:1-3Dockerfile:1-6

Lab assessment

Vulnerability lab

The README explicitly describes CVE-2021-21341, provides a Docker demo, and includes steps to build and run the environment to observe the vulnerability. The Java source contains a crafted XML payload designed to trigger an endless loop in XStream.

README.md:1-3README.md:7-9src/main/java/main.java:6-35
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

build environmentruntime environment

Uses maven:3.8.1-amazoncorretto-8 base image, copies the project source, builds it with mvn package, and runs the resulting JAR.

Dockerfile:1-6

pom.xml

dependency declarationbuild configuration

Declares a dependency on XStream 1.4.15 and configures the maven-shade-plugin to create an executable JAR with main class 'main'.

pom.xml:10-14pom.xml:24-30

main.java

vulnerability triggerproof-of-concept

Contains a main method that constructs a malicious XML string and deserializes it with a default XStream instance, triggering the CVE-2021-21341 DoS.

src/main/java/main.java:1-37

README.md

documentationexercise instructions

Explains the vulnerability, provides Docker build/run commands, shows expected output, and suggests remediation steps.

README.md:1-69
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-21341

Supported by supplied evidence

The README states the vulnerability affects XStream up to 1.4.15, and the pom.xml declares version 1.4.15. The Java code uses a default XStream instance to unmarshal a crafted XML payload that manipulates a ByteArrayInputStream, matching the CVE description of an endless loop causing DoS.

README.md:7-9pom.xml:12-14src/main/java/main.java:6-35
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:25-27
  • The Docker build context must include the pom.xml and src directory.Dockerfile:4

Evidence-described exercise path

  1. Build the Docker image using 'docker build -t cve-2021-21341 .'README.md:25-27
  2. Run the container with 'docker run -it --rm cve-2021-21341' to execute the JAR and observe the endless loop.README.md:29-31
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment only builds and runs a Java application that triggers a DoS within the container. There are no instructions or visible behaviors that escape the container, access the host, connect to external systems, persist data, steal credentials, or perform any destructive actions. The Dockerfile does not use privileged mode or mount sensitive host paths.

Dockerfile:1-6src/main/java/main.java:1-37
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

Showing 12 of 22