XStream is vulnerable to an Arbitrary Code Execution attack

CVE-2021-21347 is a deserialization vulnerability in XStream versions prior to 1.4.16. The library reconstructs Java objects based on type information embedded in XML input. An attacker can inject malicious type references into the stream, causing XStream to load and execute arbitrary code from a remote server [2][4].

To exploit this, a remote attacker sends a crafted XML payload to an application that unmarshals XStream data without proper safeguards. No authentication is required if the application processes untrusted input. The vulnerability affects the default blacklist-based security configuration; users who have implemented a whitelist of allowed types are not impacted [3][4].

Successful exploitation grants the attacker arbitrary code execution in the context of the XStream process, potentially leading to full server compromise. The CVSS score is 9.8, reflecting critical severity [3].

Mitigation requires upgrading to XStream 1.4.16 or later. Alternatively, users can configure the security framework with a strict whitelist of permitted classes as recommended by the vendor [2][4].