PT-2021-22408 · Xstream+6 · Xstream+6

Published 2021-08-23 · Updated 2023-03-13 · CVE-2021-39151

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.18

Description XStream is a library used to serialize objects to XML and back again. This issue may allow a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who set up XStream's security framework with a whitelist limited to the minimal required types are not affected.

Recommendations For versions prior to 1.4.18, consider setting up XStream's security framework with a whitelist limited to the minimal required types as a temporary workaround until a patch is available. Update to XStream version 1.4.18 or later, which no longer uses a blacklist by default.

Exploit

Fix

Deserialization of Untrusted Data

Unrestricted File Upload

Weakness Enumeration

CWE-502

CWE-434

Related Identifiers

ALT-PU-2022-7660

CVE-2021-39151

DLA-2769-1

DSA-5004-1

ELSA-2021-3956

GHSA-HPH2-M3G5-XXV4

MGASA-2021-0474

OESA-2021-1337

OPENSUSE-SU-2021:1401-1

OPENSUSE-SU-2021:3476-1

OPENSUSE-SU-2021_1401-1

OPENSUSE-SU-2021_3476-1

RHSA-2021:3956

RHSA-2021_3956

SUSE-SU-2021:3476-1

USN-5946-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Hat

Suse

Ubuntu

Xstream

References · 93

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb · Exploit
• 🔥 https://github.com/jas502n/CVE-2020-26259 · Exploit
• 🔥 https://github.com/MyBlackManba/CVE-2021-29505 · Exploit
• 🔥 https://github.com/111ddea/Xstream_cve-2022-41966 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2020-26259 · Exploit
• 🔥❌ https://github.com/b3wT/CVE-2021-39144-XSTREAM-RCE · Exploit, Deleted
• 🔥 https://x-stream.github.io/CVE-2021-39151.html · Exploit
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://ubuntu.com/security/CVE-2021-39146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39144 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39139 · Security Note
• https://ubuntu.com/security/CVE-2021-39139 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5946-1 · Vendor Advisory