CVE-2021-21342: 
Java vulnerability analysis and mitigation

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types (GitHub Advisory, XStream CVE).

The vulnerability exists in the unmarshalling process where XStream creates new instances based on type information contained in the processed stream. The attack can be performed by creating a simple PriorityQueue, marshalling it to XML, and then replacing the XML with malicious content that triggers a server-side request forgery. This vulnerability works with both XML and JSON formats (XStream CVE).

The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. This could potentially expose sensitive information from intranet or localhost resources (GitHub Advisory, XStream CVE).

The vulnerability has a CVSS v3.1 base score of 9.1 (Critical) with attack vector being Network, attack complexity Low, requiring no privileges or user interaction. The scope is Unchanged with High impact on both Confidentiality and Integrity (NVD).

Users should upgrade to XStream version 1.4.16 or later. For those who cannot upgrade immediately, it is recommended to setup XStream's security framework with a whitelist limited to the minimal required types. The security framework has been available since version 1.4.7 and allows defining which types are allowed to be unmarshalled (XStream Security).