CVE-2021-29505

HIGH NUCLEI

XStream < 1.4.17 - Remote Code Execution via Untrusted Data Deserialization

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2021-29505. PoCs published by MyBlackManba, JAckLosingHeart, cuijiung. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2021-29505, leveraging XStream deserialization with a crafted XML payload to achieve remote code execution via a malicious RMI server. The PoC uses the CommonsCollections6 gadget chain and includes detailed reproduction steps.

Description

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

Exploits (3)

nomisec WORKING POC 6 stars
by MyBlackManba · poc
https://github.com/MyBlackManba/CVE-2021-29505

This repository contains a functional exploit PoC for CVE-2021-29505, leveraging XStream deserialization with a crafted XML payload to achieve remote code execution via a malicious RMI server. The PoC uses the CommonsCollections6 gadget chain and includes detailed reproduction steps.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: XStream (versions affected by CVE-2021-29505)
No auth needed
Prerequisites: Java environment · XStream library · Commons Collections library · ysoserial tool for RMI server setup
devstral-2 · analyzed Feb 18, 2026 Full analysis →
github WORKING POC 5 stars
by JAckLosingHeart · javapoc
https://github.com/JAckLosingHeart/CVE-PoC-Collection/tree/main/xstream-CVE-2021-29505

This is a functional exploit PoC for CVE-2021-29505, demonstrating a deserialization vulnerability in XStream. The code constructs a malicious XML payload that, when deserialized, triggers a chain of gadgets leading to arbitrary code execution via RMI registry interaction.

Classification
Working Poc 95%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: XStream (versions prior to 1.4.18)
No auth needed
Prerequisites: XStream library in classpath · Network access to attacker-controlled RMI server
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC
by cuijiung · poc
https://github.com/cuijiung/xstream-CVE-2021-29505

This repository contains a functional exploit PoC for CVE-2021-29505, leveraging XStream deserialization to achieve remote code execution via a crafted XML payload. The payload uses a chain of Java classes to trigger JNDI injection, targeting RMI endpoints.

Classification
Working Poc 95%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: XStream (versions prior to 1.4.18)
No auth needed
Prerequisites: XStream library in classpath · Network access to attacker-controlled RMI endpoint
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

XStream <1.4.17 - Remote Code Execution
HIGHby pwnhxl

References (20)

Core 20
Core References
Mailing List, Third Party Advisory x_refsource_misc
https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html
Third Party Advisory x_refsource_misc
https://www.debian.org/security/2021/dsa-5004
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2022.html
Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujul2022.html
Mailing List, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuoct2021.html
Various Sources x_refsource_misc
https://x-stream.github.io/CVE-2021-29505.html

Scores

CVSS v3 7.5
EPSS 0.9035
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502 CWE-94
Status published
Products (42)
com.thoughtworks.xstream/xstream 0 - 1.4.17Maven
debian/debian_linux 9.0
debian/debian_linux 10.0
debian/debian_linux 11.0
fedoraproject/fedora 33
fedoraproject/fedora 34
fedoraproject/fedora 35
netapp/snapmanager (2 CPE variants)
oracle/banking_cash_management 14.2
oracle/banking_cash_management 14.3
... and 32 more
Published May 28, 2021
Tracked Since Feb 18, 2026