Back to KEVs

CVE-2021-39144

XStream is vulnerable to a Remote Command Execution attack

Basic Information

CVE State
PUBLISHED
Reserved Date
August 16, 2021
Published Date
August 23, 2021
Last Updated
February 06, 2025
Vendor
x-stream
Product
xstream
Description
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

CVSS Scores

CVSS v3.1

8.5 - HIGH

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC Information

Exploitation
active
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (added 2023-03-10 00:00:00 UTC) Source

References

https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh https://x-stream.github.io/CVE-2021-39144.html https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ https://www.debian.org/security/2021/dsa-5004 https://www.oracle.com/security-alerts/cpujan2022.html https://security.netapp.com/advisory/ntap-20210923-0003/ https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujul2022.html http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html

Known Exploited Vulnerability Information

Source Added Date
CISA 2023-03-10 00:00:00 UTC

Scanner Integrations

Scanner URL Date Detected
Metasploit https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb 2025-04-29 11:01:15 UTC
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39144.yaml 2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

vmware_nsxmgr_xstream_rce_cve_2021_39144

Type: metasploit • Created: Unknown

Metasploit module for CVE-2021-39144