CVE-2021-39144

Deeper analysis

XStream is a Java library used to serialize objects to XML and deserialize them back. CVE-2021-39144 is a deserialization vulnerability (CWE-502) combined with code injection (CWE-94) and missing authentication (CWE-306) that affects versions prior to 1.4.18. An attacker who can supply a crafted input stream can trigger arbitrary command execution on the host system. The issue stems from reliance on a blacklist that proved insufficient to prevent instantiation of dangerous types during unmarshalling.

A remote attacker with limited privileges can exploit the flaw over the network by manipulating the processed XML input. Successful exploitation yields full command execution on the target host, resulting in complete compromise of confidentiality, integrity, and availability with scope change, as reflected in the CVSS 8.5 rating. No interaction or special user interface actions are required beyond the ability to influence the deserialized stream.

Advisories recommend migrating to XStream 1.4.18 or later, which disables the insecure blacklist default and requires an explicit whitelist of only the minimal required types. The GitHub security advisory and downstream notices from Debian and Fedora list the affected packages and provide updated builds that enforce this safer configuration. A public exploit targeting VMware NSX Manager demonstrates that unauthenticated remote code execution is achievable in at least one widely deployed product when the vulnerable library is present without additional hardening.