CVE-2021-21349 - CVE House

Back to Database

Status published Medium CVE-2021-21349

A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

6.1 CVSS

Vulnerability Description

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21349

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from x-stream

View All →

XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream

XStream Denial of Service via stack overflow

Denial of Service by injecting highly recursive collections or maps in XStream

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

Affected Vendor

x-stream

View all reports →

Affected Software

xstream

Vulnerable Versions:

< 1.4.16

Timeline

Official Publish: March 22nd, 2021

Last Modified: August 3rd, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Weaknesses (CWE)

CWE-502 CWE-918

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1005 Data from Local System

T1046 Network Service Discovery