XStream is vulnerable to an Arbitrary Code Execution attack

Vulnerability

Overview CVE-2021-21351 is a deserialization vulnerability in XStream, a Java library for XML serialization. The flaw resides in the unmarshalling process where type information from the input stream is used to create objects. An attacker can inject malicious data to load and execute arbitrary code from a remote host [1][3].

Exploitation

The attack requires no authentication, only the ability to supply a manipulated input stream to XStream. The proof-of-concept in [4] demonstrates how to craft an XML payload using a TreeSet and JNDI injection to trigger remote code execution. This is possible because XStream's default blacklist is insufficient; a whitelist-based security framework is recommended [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the server, potentially leading to full system compromise, data theft, or denial of service [2].

Mitigation

Users should upgrade to XStream 1.4.16 or later [1]. If upgrading is not possible, configure XStream's security framework with a whitelist of allowed classes to limit the attack surface [2].