CVE-2021-21346: NetApp OnCommand Insight RCE Vulnerability

CVE-2021-21346 Overview

CVE-2021-21346 is a critical insecure deserialization vulnerability in XStream, a popular Java library used to serialize objects to XML and back again. In XStream versions prior to 1.4.16, a remote attacker can load and execute arbitrary code from a remote host by manipulating the processed input stream. This vulnerability bypasses XStream's default blacklist security controls, enabling full remote code execution without authentication.

Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. However, organizations relying on XStream's default blacklist protections are at significant risk and must upgrade to version 1.4.16 or later immediately.

Critical Impact

Remote attackers can achieve arbitrary code execution on vulnerable systems by sending specially crafted XML payloads, potentially leading to complete system compromise without any user interaction.

Affected Products

• XStream versions prior to 1.4.16
• Apache ActiveMQ (versions 5.16.0, 5.16.1, and earlier releases)
• Apache JMeter (multiple versions)
• NetApp OnCommand Insight
• Debian Linux 9.0, 10.0, and 11.0
• Fedora 33, 34, and 35
• Oracle Banking Enterprise Default Management 2.10.0, 2.12.0
• Oracle Banking Platform 2.4.0, 2.7.1, 2.9.0, 2.12.0
• Oracle Banking Virtual Account Management 14.2.0, 14.3.0, 14.5.0
• Oracle BI Publisher 5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0
• Oracle Business Activity Monitoring 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
• Oracle Communications Billing and Revenue Management Elastic Charging Engine 12.0.0.3.0
• Oracle Communications Policy Management 12.5.0
• Oracle Communications Unified Inventory Management 7.3.2, 7.3.4, 7.3.5, 7.4.0, 7.4.1
• Oracle Retail XStore Point of Service 16.0.6, 17.0.4, 18.0.3, 19.0.2
• Oracle WebCenter Portal 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0

Discovery Timeline

• 2021-03-23 - CVE-2021-21346 published to NVD
• 2025-05-23 - Last updated in NVD database

Technical Details for CVE-2021-21346

Vulnerability Analysis

This vulnerability exploits a weakness in XStream's XML deserialization process. XStream allows Java objects to be serialized to XML and reconstructed from XML, but without proper type restrictions, an attacker can inject malicious class references into the XML stream. When XStream processes these crafted payloads, it instantiates arbitrary classes and executes their methods, leading to remote code execution.

The vulnerability specifically affects applications that rely on XStream's default blacklist-based security model. The blacklist approach attempts to block known dangerous classes, but attackers discovered gadget chains that circumvent these restrictions. This is a classic example of why whitelist-based security controls are fundamentally more secure than blacklist approaches for deserialization vulnerabilities.

The attack requires no authentication and can be executed over the network against any application that deserializes untrusted XML input using vulnerable XStream versions. Successful exploitation grants the attacker the same privileges as the application processing the malicious XML.

Root Cause

The root cause is XStream's insufficient type validation during deserialization combined with the inherent weakness of blacklist-based security. XStream's Security Framework relies on a blacklist of known dangerous types to prevent deserialization attacks. However, this approach fails because:

1. The blacklist cannot anticipate all potentially dangerous class combinations
2. New gadget chains can be discovered that use classes not on the blacklist
3. Complex class loading mechanisms can bypass type restrictions

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), reflecting the dangerous file/object handling that enables arbitrary code loading and execution.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker crafts a malicious XML payload containing references to dangerous Java classes arranged in a specific sequence known as a "gadget chain." When an application using a vulnerable XStream version deserializes this XML, the following occurs:

1. XStream parses the XML and identifies the class types to instantiate
2. The blacklist check fails to recognize the malicious class combination
3. XStream instantiates the specified classes and invokes their methods
4. The gadget chain executes, ultimately loading and running arbitrary code from an attacker-controlled remote host

The attack payload is delivered through any endpoint that accepts and processes XML input using XStream, such as REST APIs, SOAP services, message queues, or configuration file processors.

Detection Methods for CVE-2021-21346

Indicators of Compromise

• Unusual outbound network connections from Java applications to unknown external hosts
• Unexpected Java process spawning or command execution on application servers
• Log entries showing XStream deserialization errors with unusual class names
• Network traffic containing XML payloads with suspicious class references such as java.lang.ProcessBuilder, javax.script.ScriptEngineManager, or reflection-related classes
• Abnormal CPU or memory utilization in XStream-dependent applications

Detection Strategies

• Implement network monitoring to detect XML payloads containing known XStream deserialization gadget class names
• Deploy application-level logging to capture all XStream deserialization operations and alert on unexpected class types
• Use runtime application self-protection (RASP) solutions to detect and block deserialization attacks
• Monitor for process creation events from Java applications that may indicate successful exploitation
• Conduct regular vulnerability scanning of application dependencies to identify outdated XStream versions

Monitoring Recommendations

• Enable verbose logging for XStream operations to capture deserialization attempts with detailed class information
• Configure SIEM rules to correlate network anomalies with Java application behavior
• Monitor Java application heaps and stack traces for evidence of gadget chain execution
• Implement egress filtering and monitor for unexpected outbound connections from application servers
• Deploy file integrity monitoring on systems running vulnerable applications to detect post-exploitation activity

How to Mitigate CVE-2021-21346

Immediate Actions Required

• Upgrade XStream to version 1.4.16 or later immediately on all affected systems
• Implement XStream's security framework with explicit whitelist configuration limiting deserialization to only required types
• Audit all applications using XStream to identify those relying on default blacklist security
• Review and restrict network access for applications that cannot be immediately patched
• Validate all upstream dependencies for XStream usage, particularly in Apache ActiveMQ and Apache JMeter deployments

Patch Information

The vulnerability is resolved in XStream version 1.4.16 and later. Organizations should update their XStream dependencies immediately. For detailed release information, see the XStream Release Notes 1.4.16.

Multiple vendors have released security advisories and patches:

• Oracle CPU January 2022 Alert
• Oracle CPU October 2021 Alert
• Oracle CPU July 2021 Alert
• NetApp Security Advisory NTAP-20210430-0002
• Debian Security DSA-5004

For additional technical details, refer to the GitHub Security Advisory GHSA-4hrm-m67v-5cxr and XStream CVE-2021-21346 Details.

Workarounds

• Configure XStream's Security Framework with an explicit whitelist of allowed types instead of relying on the default blacklist; see the XStream Security Workaround Information for implementation guidance
• Disable XStream deserialization of untrusted input entirely if the functionality is not required
• Implement network segmentation to limit exposure of vulnerable applications to untrusted networks
• Deploy web application firewalls (WAF) with rules to detect and block common XStream gadget chain patterns in XML payloads
• Consider using alternative serialization libraries with stronger default security postures for new development

# Example XStream whitelist configuration in Java
# Add this configuration before using XStream to deserialize any input
XStream xstream = new XStream();
xstream.addPermission(NoTypePermission.NONE);
xstream.addPermission(NullPermission.NULL);
xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
xstream.allowTypes(new Class[] { YourAllowedClass.class });
xstream.allowTypesByWildcard(new String[] { "com.yourcompany.model.**" });