CVE-2021-21351

MEDIUMNuclei

XStream is vulnerable to an Arbitrary Code Execution attack

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-21351 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

xstream

Browse x-stream / xstream
CVE List< 1.4.16affected

com.thoughtworks.xstream:xstream

Browse Maven / com.thoughtworks.xstream:xstream
GitHub AdvisoryBefore 1.4.16 · Fixed in 1.4.16affected

Nuclei templates

1
ProjectDiscoveryCRITICALXStream <1.4.16 - Remote Code ExecutionCVSS 9.1

XStream before 1.4.16 is susceptible to remote code execution. An attacker can load and execute arbitrary code from a remote host via manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.

Remediation

Install at least 1.4.16 if you rely on XStream's default blacklist of the Security Framework.

WeaknessesCWE-434
Authorspwnhxl
Template tagscve2021cvexstreamdeserializationrceoastvulhubxstream_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CPE: cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*
https://github.com/vulhub/vulhub/tree/master/xstream/CVE-2021-21351 https://x-stream.github.io/CVE-2021-21351.html https://paper.seebug.org/1543/ http://x-stream.github.io/changes.html#1.4.16 https://nvd.nist.gov/vuln/detail/CVE-2021-21351

Source: ProjectDiscovery

References

Showing 12 of 22