Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

XStream library can be tricked into internal network calls

CVE-2021-21342 · published 5 years ago
Summary

The XStream Java library used by several products (including ThoughtWorks XStream, NetApp OnCommand Insight, Apache ActiveMQ, Apache JMeter, and XStream itself) can be fed specially crafted data that makes the server reach out to addresses inside your private network or its own host. This could let an attacker cause the server to access hidden resources. Update to version 1.4.16 or later, or configure XStream to allow only the specific object types your application needs.

What to do
  • Update thoughtworks com.thoughtworks.xstream:xstream to version 1.4.16.
  • Update apache activemq to version 5.15.14 or later.
  • Update apache jmeter to version 5.5 or later.
  • Update xstream xstream to version 1.4.16 or later.
Affected software
Ecosystem VendorProductAffected versions
maven thoughtworks com.thoughtworks.xstream:xstream < 1.4.16
Fix: upgrade to 1.4.16
– netapp oncommand_insight All versions
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
– apache activemq < 5.15.14
5.16.0
5.16.1
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
– apache jmeter < 5.5
cpe:2.3:a:apache:jmeter:*:*:*:*:*:*:*:*
– xstream xstream < 1.4.16
cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*
– debian debian_linux 9.0
10.0
11.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
– fedoraproject fedora 33
34
35
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
– oracle banking_enterprise_default_management 2.10.0
2.12.0
cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*
– oracle banking_platform 2.4.0
2.7.1
2.9.0
2.12.0
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
– oracle banking_virtual_account_management 14.2.0
14.3.0
14.5.0
cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*
– oracle business_activity_monitoring 11.1.1.9.0
12.2.1.3.0
12.2.1.4.0
cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*
– oracle communications_brm_-_elastic_charging_engine 12.0.0.3
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*
– oracle communications_policy_management 12.5.0
cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*
– oracle communications_unified_inventory_management 7.3.2
7.3.4
7.3.5
7.4.0
7.4.1
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.2:*:*:*:*:*:*:*
– oracle retail_xstore_point_of_service 16.0.6
17.0.4
18.0.3
19.0.2
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*
– oracle webcenter_portal 11.1.1.9.0
12.2.1.3.0
12.2.1.4.0
cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*
– x-stream xstream < 1.4.16
Original advisory text
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.1 Critical
Exploitation
50% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published23 Mar 2021
Updated9 Oct 2026
First seen6 Mar 2026
Sources
GHSA-hvv8-336g-rx3m · GHSA
CVE-2021-21342 · NVD
CVE-2021-21342 · OSV
CVE-2021-21342 · MITRE
Track software like this
Free during beta