External risk intelligence

XStream Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2021-21351

XStream is a widely used serialization library embedded in numerous enterprise applications, including web servers, application portals, and API gateways. Because these products often process untrusted XML input from network requests, the vulnerable functionality is frequently reachable via internet-facing interfaces in common real-world deployments.

Unrestricted File Upload

Netapp Oncommand Insight

before 5.15.145.16.05.16.1before 5.5before 1.4.169.010.011.03334352.10.02.12.02.4.02.7.12.9.014.2.014.3.014.5.011.1.1.9.012.2.1.3.012.2.1.4.012.0.0.3.0;...

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the XStream Java library could allow remote attackers to execute arbitrary code by manipulating input streams. This is particularly concerning for applications that process untrusted XML data. While specific configurations can mitigate this risk, reliance on default security settings may expose systems. The main concern is confirming relevance and exposure.

Unsanitized input can lead to code execution.
It's a critical risk for many Java applications.
Verify XStream usage and security configurations.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by providing specially crafted XML input to a system using XStream for deserialization. If the system has not configured XStream's security framework with a restrictive whitelist, the attacker could then load and execute arbitrary code from a remote host.

Remote, unauthenticated access required.
Manipulated input stream triggers vulnerability.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker to execute arbitrary code by manipulating processed input streams. This is only a risk for users who have not configured XStream's security framework with a whitelist, or who rely on its default blacklist.

Arbitrary code execution.
Manipulated input streams.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability, affecting the XStream Java library, requires a coordinated effort across application owners, platform teams, and potentially vendor-management teams. The immediate first step should be to identify all instances of XStream within your environment, assess their exposure (especially to untrusted input), and confirm ownership. Once identified and prioritized, remediation or mitigation planning can commence.

Application owners should own this issue.
Verify XStream's security framework configuration.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is XStream and why is it used?

XStream is a Java library designed to convert objects into XML and back again, a process called serialization. It is widely used by many enterprise software products, including application portals, banking platforms, and messaging servers, to manage data exchange and integration.

How does CVE-2021-21351 cause a security weakness?

This vulnerability involves insecure deserialization, categorized as CWE-502 and CWE-434. It occurs when the library processes untrusted input in a way that allows a remote attacker to manipulate the data stream, potentially tricking the application into loading and running unauthorized code from a remote host.

Do I need specific conditions to trigger this bug?

Yes. An attacker must send specially crafted XML input to the application. The vulnerability does not impact users who have configured XStream’s security framework with a strict whitelist that only allows required data types. Reliance on default blacklisting, rather than a strict whitelist, is what leaves the system exposed.

Why is this CVE considered relevant for my environment?

Halo Surface Signal notes that XStream is frequently embedded in internet-facing components like web servers and API gateways. Because these interfaces often process untrusted XML data from the network, the vulnerable functionality is often reachable, increasing the potential risk for systems that have not implemented a strict whitelist.

What is the recommended first step for response?

The primary step is to conduct an inventory to identify all applications using XStream within your infrastructure. Once identified, you should confirm whether these instances rely on the default security settings or have already implemented a restrictive whitelist, then prioritize updates to version 1.4.16 or higher where necessary.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.