External risk intelligence

XStream XML Deserialization Command Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2021-21345

XStream is a widely used Java serialization library embedded in many enterprise products and web applications, including gateways, portals, and management interfaces. Because it is often used to process XML input in network-exposed services and APIs, it is commonly reachable in internet-facing deployment patterns, leading to a high likelihood of exposure.

Code Injection

Netapp Oncommand Insight

before 5.15.145.16.05.16.1before 5.5before 1.4.169.010.011.03334352.10.02.12.02.4.02.7.12.9.014.2.014.3.014.5.011.1.1.9.012.2.1.3.012.2.1.4.012.0.0.3.0;...

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in the XStream Java library, which is used for object serialization. The flaw could allow a remote attacker with specific privileges to execute commands on the host system by manipulating input data. While users who have implemented XStream's security framework with a strict whitelist are not affected, those relying on default settings need to ensure they are using a version that mitigates this risk.

A library flaw allows remote command execution.
Many products use this library, increasing exposure.
Confirm XStream usage and apply security recommendations.

Attack Path

How an attacker could exploit the issue

An attacker with limited privileges could send a specially crafted XML input to an application that uses a vulnerable version of XStream. If the application processes this input without proper security configurations, the attacker could execute commands on the host system.

Attacker needs low-level access.
Triggered by processing manipulated input.
Enables host command execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker with sufficient privileges could execute arbitrary commands on the host system by manipulating the input stream processed by XStream. This vulnerability is mitigated if XStream's security framework is configured with a whitelist of only the necessary types.

System commands and control.
Manipulating processed input streams.
Host command execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The XStream library's serialization vulnerability impacts applications that process untrusted input, potentially allowing command execution. Responsibility for remediation typically falls to application owners and platform teams who manage Java environments, with network and security teams involved in exposure assessment. The immediate first step should be to inventory all XStream deployments, determine their reachability and criticality, and confirm the accountable owners before planning remediation.

Application and platform teams own remediation.
Verify XStream usage and exposure.
Plan updates or security framework configuration.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is XStream and why is it used?

XStream is a Java library designed to convert objects into XML format and back again, a process called serialization and deserialization. Developers commonly embed it into enterprise products, web applications, portals, and various management interfaces to handle data interchange. Because it effectively translates complex data structures, it serves as a foundational component for many systems that need to communicate or store information in XML.

What kind of vulnerability is CVE-2021-21345?

This vulnerability involves improper input validation, specifically categorized under weaknesses like Deserialization of Untrusted Data and Command Injection. In plain terms, the library can be tricked into interpreting malicious data as legitimate instructions. Instead of just reading the XML, the application inadvertently executes unauthorized system commands contained within that input, potentially granting an attacker control over the host.

How does an attacker trigger this flaw?

An attacker triggers this by sending a specially crafted XML input stream to an application that uses a vulnerable version of XStream. If the application relies on XStream's default security framework, it will process the malicious input and execute the embedded commands. Notably, this risk is eliminated if the developer has already configured a strict whitelist that only allows specific, trusted types to be processed.

Who should be concerned about this vulnerability?

Teams managing applications that process external XML data should be concerned. According to Halo Surface Signal, this library is frequently found in internet-facing deployment patterns, such as gateways and APIs, making it highly reachable for remote attackers. If your environment includes services that accept and deserialize XML from users or network sources, you are more likely to have exposed surfaces.

What is the first step to address this risk?

Start by identifying all applications in your environment that rely on the XStream library. Once you have an inventory, determine which instances are processing untrusted input from the network. The most direct fix is to upgrade to a version that addresses the vulnerability; alternatively, if an immediate update is not possible, ensure the security framework is configured with a rigid whitelist of only necessary types.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.