CVE-2021-39151

Q: What is the severity of CVE-2021-39151?

CVE-2021-39151 has a CVSS score of 8.5 (HIGH). CVE-2021-39151 is a remote code execution vulnerability in XStream library versions before 1.4.18. Attackers can manipulate XML input to execute arbitrary code on affected systems. Only users who haven't implemented XStream's security framework with a minimal type whitelist are vulnerable.

8.5 HIGH

Remote Code Execution Deserialization

📋 TL;DR

CVE-2021-39151 is a remote code execution vulnerability in XStream library versions before 1.4.18. Attackers can manipulate XML input to execute arbitrary code on affected systems. Only users who haven't implemented XStream's security framework with a minimal type whitelist are vulnerable.

💻 Affected Systems

Products:

XStream

Versions: All versions before 1.4.18

Operating Systems: All operating systems running Java applications using XStream

Default Config Vulnerable: ⚠️ Yes

Notes: Default configuration is vulnerable. Only users who implemented the security framework with minimal whitelist are protected.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise allowing remote attackers to execute arbitrary commands, install malware, exfiltrate data, or pivot to other systems.

🟠

Likely Case

Remote code execution leading to data theft, service disruption, or lateral movement within the network.

🟢

If Mitigated

No impact if proper security framework with minimal whitelist is configured as recommended.

🌐 Internet-Facing: HIGH - Remote exploitation without authentication makes internet-facing systems prime targets.

🏢 Internal Only: MEDIUM - Internal systems could still be exploited via compromised accounts or malicious insiders.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending malicious XML input to applications using XStream for deserialization.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.4.18

Vendor Advisory: https://github.com/x-stream/xstream/security/advisories/GHSA-hph2-m3g5-xxv4

Restart Required: Yes

Instructions:

1. Update XStream dependency to version 1.4.18 or later. 2. For Maven: Update pom.xml to <version>1.4.18</version>. 3. For Gradle: Update build.gradle to implementation 'com.thoughtworks.xstream:xstream:1.4.18'. 4. Rebuild and redeploy application. 5. Restart affected services.

🔧 Temporary Workarounds

Implement Security Framework Whitelist

all

Configure XStream's security framework to only allow minimal required types

XStream xstream = new XStream();
xstream.addPermission(new NoTypePermission());
xstream.allowTypes(new Class[]{YourAllowedClass.class});

🧯 If You Can't Patch

Implement strict input validation and sanitization for all XML input
Deploy network segmentation and restrict access to services using XStream

🔍 How to Verify

Check if Vulnerable:

Check application dependencies for XStream version <1.4.18. For Java applications: check pom.xml, build.gradle, or manifest files.

Check Version:

For Maven: mvn dependency:tree | grep xstream. For Gradle: gradle dependencies | grep xstream. For JAR: java -jar your-app.jar --version or check MANIFEST.MF.

Verify Fix Applied:

Verify XStream version is 1.4.18 or higher in dependencies and test XML deserialization functionality.

📡 Detection & Monitoring

Log Indicators:

Unusual XML payloads in application logs
Java exception stack traces containing XStream classes
Unexpected process or network connections from application

Network Indicators:

Large or unusual XML payloads to application endpoints
Outbound connections to unexpected external IPs from application server

SIEM Query:

source="application.log" AND "XStream" AND ("Exception" OR "Error")

📊 Metadata

CVE ID: CVE-2021-39151

CVSS v3 Score: 8.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-434

Published: August 23, 2021

Last Updated: May 23, 2025

🔗 References

https://github.com/x-stream/xstream/security/advisories/GHSA-hph2-m3g5-xxv4 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ Mailing List
https://security.netapp.com/advisory/ntap-20210923-0003/ Third Party Advisory
https://www.debian.org/security/2021/dsa-5004 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
https://x-stream.github.io/CVE-2021-39151.html Exploit,Third Party Advisory
https://github.com/x-stream/xstream/security/advisories/GHSA-hph2-m3g5-xxv4 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html Mailing List,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ Mailing List
https://security.netapp.com/advisory/ntap-20210923-0003/ Third Party Advisory
https://www.debian.org/security/2021/dsa-5004 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
https://x-stream.github.io/CVE-2021-39151.html Exploit,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Business Activity Monitoring by Oracle

Commerce Guided Search by Oracle

Communications Billing And Revenue Management Elastic Charging Engine by Oracle

Communications Billing And Revenue Management Elastic Charging Engine by Oracle

Communications Cloud Native Core Automated Test Suite by Oracle

Communications Cloud Native Core Binding Support Function by Oracle

Communications Cloud Native Core Policy by Oracle

Communications Unified Inventory Management by Oracle

Communications Unified Inventory Management by Oracle

Communications Unified Inventory Management by Oracle

Communications Unified Inventory Management by Oracle

Communications Unified Inventory Management by Oracle

Debian Linux by Debian

Debian Linux by Debian

Debian Linux by Debian

Fedora by Fedoraproject

Fedora by Fedoraproject

Fedora by Fedoraproject

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Snapmanager by Netapp

Snapmanager by Netapp

Utilities Framework by Oracle

Utilities Framework by Oracle

Utilities Framework by Oracle

Utilities Framework by Oracle

Utilities Framework by Oracle

Utilities Framework by Oracle

Utilities Framework by Oracle

Utilities Testing Accelerator by Oracle

Webcenter Portal by Oracle

Webcenter Portal by Oracle

Xstream by Xstream

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Implement Security Framework Whitelist

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities