XStream is vulnerable to an Arbitrary Code Execution attack

Vulnerability

CVE-2021-21350 is an arbitrary code execution vulnerability in XStream, a Java library for XML serialization. The root cause is that XStream relies on type information in the processed input stream to recreate objects during unmarshalling. An attacker can replace or inject malicious objects into the XML stream, leading to the execution of arbitrary code. [1] [2] [4]

Exploitation

The attack is remote and requires no authentication; the attacker only needs to provide a specially crafted XML (or other supported format like JSON) to an application that unmarshals user-supplied data using XStream. The vulnerability affects all versions up to and including 1.4.15 when using the default security framework (which uses a blacklist). Users who follow XStream's recommendation to configure a whitelist of minimal required types are not affected. [2] [3] [4]

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the server running XStream. This can lead to full compromise of the application, including data theft, file manipulation, or further lateral movement. [2] [3]

Mitigation

XStream 1.4.16 fixes the vulnerability. Users relying on the default blacklist must upgrade to at least this version. Alternatively, applications can be protected by configuring XStream's security framework with a strict whitelist. [1] [3]