XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)

Vulnerability

Details

CVE-2021-21348 is a denial of service vulnerability in XStream versions prior to 1.4.16. The root cause is an improper handling of user-supplied regular expressions during the unmarshalling of serialized data. An attacker can provide a crafted XML input that triggers a malicious regular expression evaluation, causing a single thread to consume 100% CPU indefinitely [4].

Exploitation

The attack is remotely exploitable without authentication. An attacker sends a specially crafted XML (or other supported format) to an XStream instance that has not been secured with a whitelist-based security framework. The injected data leads to the execution of a regular expression that enters an endless loop or excessive computation, as described in the advisory [4]. Users who follow the recommendation to set up a whitelist of allowed types are not affected [2].

Impact

Successful exploitation results in a denial of service: the affected thread never returns, blocking processing and potentially causing application unavailability. The vulnerability does not lead to data theft or remote code execution, but can effectively halt server operations.

Mitigation

Users should upgrade to XStream version 1.4.16 or later, which includes a fix [1]. Alternatively, deploying the security framework with a whitelist of minimal required types prevents exploitation [2].