Log in Start free

Actively exploited · Published Aug 23, 2021 · Assigned by GitHub_M

CVE-2021-39144XStream is vulnerable to a Remote Command Execution attack

High 8.5 Exploited

In plain English

A high-severity code injection in xstream from x-stream. Attackers are actively exploiting it in the wild (listed by CISA on March 10, 2023). The chance it is exploited in the next 30 days is estimated at 98.1% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High
Exploit odds (30 days)98.1%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Mar 10, 2023
Attack tooling2Metasploit, Nuclei

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 31, 2023.

Official description

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libxstream-java1.4.18-1DEBIAN-CVE-2021-39144
Debian:13libxstream-java1.4.18-1DEBIAN-CVE-2021-39144
Debian:14libxstream-java1.4.18-1DEBIAN-CVE-2021-39144
Mavencom.thoughtworks.xstream:xstream1.4.18GHSA-j9h8-phrw-h4fh
Ubuntu:22.04:LTSlibxstream-java1.4.18-2ubuntu0.1USN-5946-1

Affected products (as reported)

VendorProductVersions
x-stream xstream < 1.4.18

Weakness: CWE-94, CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References