CVE-2021-29505 XStream is vulnerable to a Remote Command Execution attack
Remote attackers can execute arbitrary host commands via manipulated input streams if XStream's security whitelist is not configured.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29505?
CVE-2021-29505 is a high-severity unsafe deserialization vulnerability in Debian Debian Linux, published on 28 May 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
Which versions are affected by CVE-2021-29505?
2 open source packages ship an affected version, including com.thoughtworks.xstream:xstream. It affects 17 products.
| Package | Affected | Fixed in |
|---|---|---|
com.thoughtworks.xstream:xstream Maven | All versions | 1.4.17 |
com.thoughtworks.xstream:xstream Maven | All versions | 1.4.17 |
Linux distribution packages (14)
xstream Red Hat:enterprise_linux:7::client | All versions | 0:1.3.1-14.el7_9 |
xstream-javadoc Red Hat:enterprise_linux:7::client | All versions | 0:1.3.1-14.el7_9 |
xstream Red Hat:enterprise_linux:7::computenode | All versions | 0:1.3.1-14.el7_9 |
xstream-javadoc Red Hat:enterprise_linux:7::computenode | All versions | 0:1.3.1-14.el7_9 |
xstream Red Hat:enterprise_linux:7::server | All versions | 0:1.3.1-14.el7_9 |
xstream-javadoc Red Hat:enterprise_linux:7::server | All versions | 0:1.3.1-14.el7_9 |
xstream Red Hat:enterprise_linux:7::workstation | All versions | 0:1.3.1-14.el7_9 |
xstream-javadoc Red Hat:enterprise_linux:7::workstation | All versions | 0:1.3.1-14.el7_9 |
xstream SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 1.4.17-3.11.2 |
xstream SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 1.4.17-3.11.2 |
xstream SUSE:Manager Server Module 4.1 | All versions | 1.4.17-3.11.2 |
xstream SUSE:Manager Server Module 4.2 | All versions | 1.4.17-3.11.2 |
xstream openSUSE:Leap 15.2 | All versions | 1.4.17-lp152.2.9.1 |
xstream openSUSE:Leap 15.3 | All versions | 1.4.17-3.11.2 |
Products include Debian Debian Linux, Fedoraproject Fedora, Netapp Snapmanager, Oracle Banking Cash Management, Oracle Banking Corporate Lending Process Management, Oracle Banking Credit Facilities Process Management and 11 more.
How do I fix CVE-2021-29505?
Upgrade com.thoughtworks.xstream:xstream to 1.4.17 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-29505 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-29505 exists.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2021-29505, DLA-2704-1, GHSA-7chv-rrw6-w6fc, OESA-2021-1208, RHSA-2021:2683, SUSE-SU-2021:1995-1 and 3 more.