CVE-2021-29505: XStream Java Library RCE Vulnerability

CVE-2021-29505 Overview

CVE-2021-29505 is a high-severity remote code execution vulnerability in XStream, a popular Java library for serializing objects to XML and back. The vulnerability allows a remote attacker with sufficient rights to execute arbitrary commands on the host system by manipulating the processed input stream during deserialization operations. This vulnerability is particularly dangerous because it affects XStream instances that have not properly configured the security framework with a whitelist of allowed types.

XStream is widely used in Java applications for XML serialization and is incorporated into numerous enterprise products from Oracle, NetApp, and other vendors, significantly expanding the attack surface for this vulnerability.

Critical Impact

Remote attackers can achieve arbitrary command execution on vulnerable systems by crafting malicious XML input, potentially leading to complete system compromise. The vulnerability has an extremely high EPSS probability of 90.769% (99th percentile), indicating significant real-world exploitation likelihood.

Affected Products

• XStream versions prior to 1.4.17
• Debian Linux 9.0, 10.0, and 11.0
• Fedora 33, 34, and 35
• NetApp SnapManager for Oracle and SAP
• Oracle Banking Cash Management 14.2, 14.3, 14.5
• Oracle Banking Corporate Lending Process Management 14.2.0, 14.3.0, 14.5.0
• Oracle Banking Credit Facilities Process Management 14.2.0, 14.3.0, 14.5.0
• Oracle Banking Supply Chain Finance 14.2.0
• Oracle Banking Trade Finance Process Management 14.5.0
• Oracle Business Activity Monitoring 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
• Oracle Communications BRM - Elastic Charging Engine 11.3, 12.0
• Oracle Communications Unified Inventory Management 7.3.4, 7.3.5, 7.4.0, 7.4.1, 7.4.2
• Oracle Enterprise Manager Ops Center 12.4.0.0
• Oracle Retail Customer Insights 15.0.2, 16.0.2
• Oracle Retail XStore Point of Service 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1
• Oracle WebCenter Portal 12.2.1.3.0, 12.2.1.4.0
• Oracle WebCenter Sites 12.2.1.3.0, 12.2.1.4.0

Discovery Timeline

• 2021-05-28 - CVE-2021-29505 published to NVD
• 2025-05-30 - Last updated in NVD database

Technical Details for CVE-2021-29505

Vulnerability Analysis

This vulnerability stems from improper handling of deserialization in XStream when the security framework is not properly initialized with a type whitelist. When XStream processes untrusted XML input without appropriate security constraints, it can instantiate arbitrary Java classes specified in the XML data. This allows attackers to leverage gadget chains present in the application's classpath to achieve remote code execution.

The core issue is that XStream, by default, does not restrict which Java types can be deserialized from XML input. When an attacker can control or influence the XML data being processed, they can craft payloads that, upon deserialization, trigger execution of arbitrary system commands. The vulnerability specifically involves types in the java.rmi.* and sun.rmi.* package hierarchies, as well as com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl.

Root Cause

The root cause is XStream's permissive default configuration that allows deserialization of arbitrary Java types without explicit authorization. When applications use XStream without configuring the security framework to whitelist only required types, they become vulnerable to deserialization attacks. The lack of input validation on the type information embedded in XML allows attackers to specify dangerous classes that can be weaponized during object reconstruction.

Attack Vector

The attack is network-based and requires low privileges to execute. An attacker must be able to submit malicious XML content to an application that uses a vulnerable XStream instance for deserialization. The attack flow involves:

1. Identifying an endpoint that accepts XML input processed by XStream
2. Crafting a malicious XML payload containing references to dangerous Java types
3. Submitting the payload to trigger deserialization
4. The XStream library instantiates the specified objects, executing attacker-controlled commands

The patch addresses this by blacklisting dangerous types by default. Below is the security patch that documents the CVE fix and the types that were blacklisted:

 	<h1 id="upcoming-1.4.x">Upcoming 1.4.x maintenance release</h1>
 
 	<p>Not yet released.</p>

+	<p class="highlight">This maintenance release addresses the security vulnerability
+	<a href="CVE-2020-26258.html">CVE-2021-29505</a>, when unmarshalling with XStream instances using an uninitialized
+	security framework.</p>
+
+	<h2>Stream compatibility</h2>
+
+	<ul>
+		<li>The following types are now blacklisted by default and the deserialization
+		of XML containing one of the two types will fail.  You will have to enable these types by explicit
+		configuration, if you need them:<br>
+			<ul>
+				<li>any type in the java.rmi.* and sun.rmi.* package hierarchies</li>
+				<li>the individual type com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl</li>
+			</ul>
+		</li>
+	</ul>
 
 	<h1 id="1.4.16">1.4.16</h1>

Source: XStream GitHub Commit 24fac82191292c6ae25f94508d28b9823f83624f

Detection Methods for CVE-2021-29505

Indicators of Compromise

• Unusual XML payloads containing references to java.rmi.*, sun.rmi.*, or com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl classes in application logs
• Unexpected process spawning from Java application processes, particularly shell invocations or network connections
• Application errors or exceptions related to XStream deserialization failures after patching attempts
• Unusual outbound network connections from servers running XStream-based applications

Detection Strategies

• Implement application-level logging for all XStream deserialization operations and monitor for suspicious class instantiation attempts
• Deploy web application firewall (WAF) rules to detect and block XML payloads containing known dangerous Java class references
• Use static analysis tools to identify XStream usage in your codebase and verify security framework configuration
• Monitor Java process behavior for signs of command injection, such as unexpected child processes or system calls

Monitoring Recommendations

• Enable detailed logging on applications using XStream and forward logs to SIEM for correlation and alerting
• Set up alerts for deserialization exceptions that may indicate attack attempts against patched systems
• Monitor network traffic for suspicious outbound connections from Java applications that could indicate successful exploitation
• Regularly scan your environment to identify applications using vulnerable XStream versions

How to Mitigate CVE-2021-29505

Immediate Actions Required

• Upgrade XStream to version 1.4.17 or later immediately on all affected systems
• If immediate upgrade is not possible, configure XStream's security framework with a strict whitelist limited to only the minimal required types
• Audit all applications in your environment to identify those using XStream and prioritize remediation based on exposure
• Review application logs for any evidence of exploitation attempts prior to patching

Patch Information

XStream version 1.4.17 addresses this vulnerability by blacklisting dangerous types by default. The patch prevents deserialization of types in the java.rmi.* and sun.rmi.* package hierarchies, as well as com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl. Users who require these types must explicitly enable them through configuration.

For the primary fix, see the XStream GitHub commit 24fac82191292c6ae25f94508d28b9823f83624f. Additional vendor patches are available from Oracle's January 2022 Security Advisory, Oracle's April 2022 Security Advisory, and the Debian Security Update DSA-5004.

For comprehensive vulnerability details and additional mitigation guidance, refer to the XStream CVE-2021-29505 Information page and the GitHub Security Advisory GHSA-7chv-rrw6-w6fc.

Workarounds

• Configure XStream's security framework with a whitelist of only the types your application requires for serialization/deserialization
• If using a version prior to 1.4.17, explicitly blacklist the java.rmi.*, sun.rmi.* packages and com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl class
• Implement input validation at the application layer to reject XML containing references to suspicious Java classes
• Consider network segmentation to limit exposure of applications using XStream to untrusted networks

// XStream Security Framework Configuration Example
XStream xstream = new XStream();
// Setup security framework with explicit type allowlist
xstream.addPermission(NoTypePermission.NONE);
xstream.addPermission(NullPermission.NULL);
xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
xstream.allowTypes(new Class[] {
    // Add only the specific types your application requires
    YourRequiredClass.class,
    AnotherAllowedClass.class
});