XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights

CVE-2021-21343 is an arbitrary file deletion vulnerability in XStream versions prior to 1.4.16. The flaw lies in how XStream handles type information during unmarshalling of XML data. By injecting specially crafted type information, an attacker can cause XStream to instantiate objects that lead to file deletion [1][4].

The attack is performed remotely by providing a manipulated XML stream to an application that uses XStream to unmarshal data. The attacker does not require authentication if the application processes user-supplied XML. The default blacklist in XStream's security framework is insufficient; users who rely on the blacklist must upgrade to 1.4.16 [3]. The vendor recommends using a whitelist of allowed types [2].

Successful exploitation allows an attacker to delete arbitrary files on the local host, provided the XStream process has sufficient file system permissions. This can lead to denial of service or data loss. The vulnerability does not affect users who have configured XStream's security framework with a whitelist [4].

Users should upgrade to XStream 1.4.16 or later. If upgrade is not possible, the workaround is to apply a whitelist-based security framework [2]. The CVE is published and patched.