CVE-2021-21345 PoC — XStream is vulnerable to a Remote Command Execution attack

Source

https://github.com/shoucheng3/x-stream__xstream_CVE-2021-21345_1-4-15

Associated Vulnerability

Title: XStream is vulnerable to a Remote Command Execution attack (CVE-2021-21345)
Description:XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Readme

master: [![Build Status](https://travis-ci.org/x-stream/xstream.svg?branch=master)](https://travis-ci.org/x-stream/xstream) [![Coverage Status](https://coveralls.io/repos/github/x-stream/xstream/badge.svg?branch=master)](https://coveralls.io/github/x-stream/xstream?branch=master)  
v-1.4.x: [![Build Status](https://travis-ci.org/x-stream/xstream.svg?branch=v-1.4.x)](https://travis-ci.org/x-stream/xstream) [![Coverage Status](https://coveralls.io/repos/github/x-stream/xstream/badge.svg?branch=v-1.4.x)](https://coveralls.io/github/x-stream/xstream?branch=v-1.4.x)

- - - -
# XStream
_Java to XML Serialization, and back again_

## Binaries
All binary artifacts are bundled in the -bin archive.  It includes
the XStream jars and any other library used at build time, or
optional runtime extras.  Xpp3 is recommend for use as it will
greatly improve the performance of XStream.

## Documentation
Documentation can be found at [GitHub](http://x-stream.github.io).  This
includes:
* [Introduction](http://x-stream.github.io) and [Tutorials](http://x-stream.github.io/tutorial.html)
* [JavaDoc](http://x-stream.github.io/javadoc/index.html)
* [Change History](http://x-stream.github.io/changes.html)
* [Frequently Asked Questions](http://x-stream.github.io/faq.html)

## Source
The complete source for XStream is bundled in the -src archive.  This includes:
* Main API [xstream/src/java]
* Unit Tests [xstream/src/test]
* Maven Build Files [pom.xml]
* Hibernate Module [xstream-hibernate]
* Website [xstream-distribution]

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →