CVE-2021-39144
XStream Remote Code Execution Vulnerability
Description
CVE-2021-39144 is a remote code execution vulnerability in XStream, a widely used Java library for serializing objects to XML and back. The vulnerability allows a remote attacker with sufficient rights to execute arbitrary commands on the host system by manipulating the processed XML input stream through unsafe deserialization. XStream versions prior to 1.4.18 that rely on the default blacklist-based security framework are affected, along with numerous downstream products from Oracle, NetApp, and other vendors that embed XStream. With a CVSS score of 8.5 (High), confirmed active exploitation tracked by CISA, and an EPSS score of 94.38% placing it at the 99.97th percentile, CVE-2021-39144 poses a severe risk to any application using vulnerable XStream versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| xstream | xstream | < 1.4.18 |
| debian | debian linux | 9.0; 10.0; 11.0 |
| fedoraproject | fedora | 33; 34; 35 |
| netapp | snapmanager | - |
| oracle | business activity monitoring | 12.2.1.4.0 |
| oracle | commerce guided search | 11.3.2 |
| oracle | communications billing and revenue management elastic charging engine | 11.3; 12.0 |
| oracle | communications cloud native core automated test suite | 1.9.0 |
| oracle | communications cloud native core binding support function | 1.10.0 |
| oracle | communications cloud native core policy | 1.14.0 |
| oracle | communications unified inventory management | 7.3.4; 7.3.5; 7.4.0; 7.4.1; 7.4.2 |
| oracle | retail xstore point of service | 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| oracle | utilities framework | 4.2.0.2.0; 4.2.0.3.0; 4.3.0.1.0; 4.3.0.6.0; 4.4.0.0.0; 4.4.0.2.0; 4.4.0.3.0 |
| oracle | utilities testing accelerator | 6.0.0.1.1 |
| oracle | webcenter portal | 12.2.1.3.0; 12.2.1.4.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh(Vendor Advisory)
- https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/(Broken Link, Mailing List, Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/(Broken Link, Mailing List, Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/(Broken Link, Mailing List, Release Notes)
- https://security.netapp.com/advisory/ntap-20210923-0003/(Third Party Advisory)
- https://www.debian.org/security/2021/dsa-5004(Third Party Advisory)
- https://www.oracle.com/security-alerts/cpuapr2022.html(Patch, Third Party Advisory)
- https://www.oracle.com/security-alerts/cpujan2022.html(Patch, Third Party Advisory)
- https://www.oracle.com/security-alerts/cpujul2022.html(Patch, Third Party Advisory)
- https://x-stream.github.io/CVE-2021-39144.html(Exploit, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39144(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
XStream's deserialization mechanism does not properly control the generation and execution of code from untrusted XML input, allowing attackers to inject and execute arbitrary code on the host system. This code injection weakness arises from the library's failure to adequately restrict which classes can be instantiated during deserialization.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
CWE-502: Deserialization of Untrusted Data
XStream deserializes XML data without sufficient validation of the incoming object types, enabling attackers to craft malicious XML payloads that instantiate dangerous classes during deserialization. This unsafe deserialization weakness is the primary attack mechanism through which remote code execution is achieved.
Learn more: CWE-502 — Deserialization of Untrusted Data
CWE-306: Missing Authentication for Critical Function
In certain deployment contexts, the XStream deserialization endpoint is exposed without proper authentication, allowing unauthenticated attackers to submit malicious XML payloads. This missing authentication weakness significantly increases the attack surface by removing the authentication barrier that would otherwise limit exploitation.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2021-39144 poses a severe threat to organizations using XStream or any of the numerous products that embed it as a dependency. Attack Vector (Network): The vulnerability is remotely exploitable over the network, allowing attackers to target any internet-facing application that processes XML through XStream. Attack Complexity (High): While exploitation requires knowledge of the target application's XStream configuration and class availability, sophisticated attackers and available exploit tools have lowered this barrier. Privileges Required (Low): An attacker needs only low-level access rights, and in some deployment configurations such as VMware NSX Manager, the vulnerability can be exploited without any authentication. User Interaction (None): No user action is required to trigger the vulnerability. Scope (Changed): Successful exploitation can affect resources beyond the vulnerable XStream component, potentially compromising the entire host system. Confidentiality, Integrity, and Availability (all High): Arbitrary command execution grants the attacker full control over the host system, enabling data theft, system modification, and service disruption. The EPSS score of 94.38% at the 99.97th percentile confirms that this vulnerability is among the most actively exploited in the current threat landscape.
Exploit Maturity
Public exploit code is available for CVE-2021-39144 via multiple sources, including Packet Storm Security targeting VMware NSX Manager and the official XStream advisory which documents the exploitation technique. CISA has confirmed active exploitation in the wild by adding CVE-2021-39144 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 31, 2023. The EPSS score of 94.38% at the 99.97th percentile indicates near-certain exploitation activity, reflecting both the broad attack surface created by XStream's widespread use in enterprise Java applications and the availability of mature exploit tooling. The VMware NSX Manager attack vector is particularly concerning as it enables unauthenticated remote code execution against a critical network infrastructure component.
Remediation
- Upgrade XStream to version 1.4.18 or later — XStream 1.4.18 switches from a blacklist-based security model to a whitelist-based approach by default, effectively mitigating CVE-2021-39144. Per CISA's directive, apply mitigations or discontinue use if patches are unavailable.
- Update all downstream products embedding XStream — Patch affected Oracle products (Commerce Guided Search, WebCenter Portal, Communications Cloud Native Core, Utilities Framework, and others), NetApp SnapManager, Debian/Fedora packages, and VMware products that bundle vulnerable XStream versions. Refer to vendor-specific advisories from Oracle CPU April 2022, Oracle CPU January 2022, and Oracle CPU July 2022 for version-specific guidance.
- Configure XStream's security framework with a strict whitelist — If immediate upgrade is not possible, explicitly configure XStream's security framework to only allow deserialization of the minimal required types. Do not rely on the blacklist-based default, as it cannot be comprehensively secured.
- Restrict access to XStream deserialization endpoints — Implement authentication and authorization controls on any endpoint that processes XML through XStream. Deploy network segmentation and WAF rules to limit exposure of deserialization-capable services.
- Audit and monitor for deserialization attacks — Review application logs for suspicious XML payloads containing known gadget chain class names. Deploy runtime application self-protection (RASP) or deserialization attack detection tools to identify exploitation attempts.
Technical Details
CVE-2021-39144 exploits a combination of unsafe deserialization (CWE-502) and code injection (CWE-94) weaknesses in the XStream library. The vulnerability targets XStream's default blacklist-based security model, which attempts to block known dangerous classes from being deserialized but cannot comprehensively prevent all attack vectors. Attackers craft malicious XML payloads that reference Java classes not covered by the blacklist, which when deserialized by XStream, trigger a chain of method calls (a "gadget chain") that ultimately leads to arbitrary command execution on the host system. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects the network-based attack vector with changed scope, meaning the exploitation can compromise systems beyond the vulnerable application. The CWE-306 (Missing Authentication) classification is relevant in deployments like VMware NSX Manager, where the XStream processing endpoint was accessible without authentication, allowing unauthenticated remote code execution. XStream 1.4.18 fundamentally addresses this by switching to a whitelist-based approach where only explicitly allowed types can be deserialized.
Frequently Asked Questions
Is CVE-2021-39144 being actively exploited?
Yes, CVE-2021-39144 is actively exploited in the wild. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 31, 2023. Public exploit code is available from multiple sources including Packet Storm Security, and the EPSS score of 94.38% confirms near-certain exploitation activity.
What products are affected by CVE-2021-39144?
CVE-2021-39144 directly affects XStream versions prior to 1.4.18. Numerous downstream products are also affected, including Oracle Commerce Guided Search, Oracle WebCenter Portal, Oracle Communications Cloud Native Core, Oracle Utilities Framework, NetApp SnapManager, Debian Linux packages, and Fedora packages. Any Java application using a vulnerable XStream version for XML deserialization is potentially at risk.
How do I fix CVE-2021-39144?
Upgrade XStream to version 1.4.18 or later, which switches to a secure whitelist-based deserialization model by default. If immediate upgrade is not feasible, configure XStream's security framework with a strict whitelist of allowed types. Also ensure all downstream products embedding XStream are updated. See the Remediation section for detailed steps.
How severe is CVE-2021-39144?
CVE-2021-39144 is rated High severity with a CVSS score of 8.5 out of 10. It enables remote code execution through unsafe deserialization, with the EPSS score at the 99.97th percentile indicating it is among the most actively exploited vulnerabilities tracked. The wide range of affected products and availability of public exploits amplify its real-world impact.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.