Find, fix and prevent vulnerabilities in your code.

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the BeanDeserializerBase.createContextual() method, which applies the per-property exclusions through _handleByNameInclusion() and then rebuilds the property map from the unfiltered original, overwriting the filtered map and restoring every property the exclusion had removed. An attacker can set fields that were marked ignored, enabling mass assignment, by supplying those property names in untrusted JSON during deserialization. Exploitation requires case-insensitive property matching to be enabled via @JsonFormat with ACCEPT_CASE_INSENSITIVE_PROPERTIES alongside per-property @JsonIgnoreProperties.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector._removeUnwantedIgnorals process. An attacker can access or modify properties that were intended to be ignored by supplying JSON input with keys matching the renamed property names, thereby bypassing intended access restrictions.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the JDKFromStringDeserializer class, which constructs InetSocketAddress and resolves the hostname through DNS at deserialization time. An attacker can force the server to issue outbound DNS lookups for chosen hostnames by submitting JSON that is deserialized into a type holding an InetSocketAddress field, with no authentication required. The observable effect is limited to DNS resolution of attacker-chosen names, useful for out-of-band interaction or internal resolver probing rather than a full outbound request, and it applies only where the application deserializes untrusted JSON into types containing such fields.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the STD_INET_ADDRESS branch in FromStringDeserializer in src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java. An attacker can trigger outbound DNS lookups and blind SSRF behavior by supplying a hostname string in JSON that is deserialized into java.net.InetAddress. When application code binds untrusted input into an InetAddress field or type, the deserializer calls InetAddress.getByName(value) on the attacker-controlled string and resolves it before any application validation runs. This lets an attacker force DNS-based callbacks or probe internal hostnames, causing unwanted network egress and leaking resolver-visible information.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.

References

• GitHub Commit jackson-databind-2.21.1
• GitHub Commit jackson-databind-3.2.1
• Maintainer's Advisory

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') through NioPathDeserializer in src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java. An attacker can force readValue() to resolve an attacker-controlled java.nio.file.Path URI by supplying a non-file scheme such as jar:, http:, s3:, or a custom provider scheme in untrusted JSON. That input reaches new URI(value) and then Path.of(uri), which falls back to ServiceLoader<FileSystemProvider> resolution and can invoke a matching provider’s getPath(uri) during deserialization. The result is unintended provider loading and provider-driven path handling inside the application, which can trigger denial of service or other side effects depending on what FileSystemProvider implementations are present on the classpath.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.10, 2.21.6, 2.22.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
• Maintainer's Advisory

Overview

org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine.

Affected versions of this package are vulnerable to Improper Validation of Consistency within Input through ComplianceUtils.verify(HttpURI, HttpFields, HttpCompliance, ComplianceViolation.Listener) in jetty-core/jetty-http/src/main/java/org/eclipse/jetty/http/ComplianceUtils.java. An attacker can bypass host consistency checks by sending a request whose :authority pseudo-header and Host header name different hosts, causing Jetty to accept the request and expose conflicting host identities to different code paths. This lets attacker-controlled host information survive inside the request, so logic that relies on Request.getServerName() or the URI authority can see one host while code reading the raw Host header sees another. In deployments that use host-based routing, ACLs, redirects, or tenant isolation, this can lead to incorrect request handling, host-based access control bypass, and attacker-influenced URL generation or logging.

Notes

• HTTP/1.1 already had its own authority/Host consistency path in HttpConnection/HttpChannelState; the gap was in the HTTP/2 and HTTP/3 server entry flow where the shared compliance check was invoked before that comparison happened.
• The mismatch check only rejects when both values are present and differ after normalizing case and default ports, so requests with only one of :authority or Host present are not part of this issue.

Remediation

Upgrade org.eclipse.jetty:jetty-server to version 9.4.61, 10.0.29, 11.0.29, 12.0.35, 12.1.9 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub PR
• GitHub PR
• GitHub PR
• GitLab Work Item
• Maintainer's Advisory

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the isSafeSubType() method of DefaultBaseTypeLimitingValidator, whose denylist of unsafe base types omits java.lang.Comparable, so the method returns true for any subtype resolved under a Comparable base. An attacker can trigger instantiation of arbitrary classes that implement Comparable, such as java.io.File to reach path-traversal primitives, by sending JSON with attacker-controlled type identifiers. This requires the application to use a bare @JsonTypeInfo with the default validator and no explicit PolymorphicTypeValidator, and a property or class whose declared base type is Comparable.

Workaround

This vulnerability can be avoided by configuring an explicit restrictive PolymorphicTypeValidator, such as a BasicPolymorphicTypeValidator allowlist passed to activateDefaultTyping(), instead of relying on the default validator.

Note: The discoverer of this vulnerability reports that "I have not identified a class implementing Comparable that yields code execution purely through deserialization".

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.10, 2.21.6, 2.22.2 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

org.eclipse.jetty:jetty-http is an is a http module for jetty server.

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input via the HttpURI class due to insufficient validation on the authority segment of a URI. An attacker can manipulate the URI parsing to redirect requests or initiate server-side requests to unintended destinations by supplying malformed URIs that bypass validation checks.

Notes:

1. This is only exploitable if the application uses decoded user data as encoded URIs in conjunction with the HttpURI class used directly;

2. The Jetty usage of the HttpURI class is not vulnerable.

Workaround

This vulnerability can be mitigated by not passing decoded user data as encoded URIs to any URI class/method, including HttpURI.

PoC

http://browser.check &@vulndetector.com/
http://browser.check #@vulndetector.com/
http://browser.check?@vulndetector.com/
http://browser.check#@vulndetector.com/
http://vulndetector.com\\/

Remediation

Upgrade org.eclipse.jetty:jetty-http to version 9.4.57.v20241219, 12.0.12 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR
• GitLab Issue

Overview

org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine.

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input via the HttpURI class due to insufficient validation on the authority segment of a URI. An attacker can manipulate the URI parsing to redirect requests or initiate server-side requests to unintended destinations by supplying malformed URIs that bypass validation checks.

Notes:

1. This is only exploitable if the application uses decoded user data as encoded URIs in conjunction with the HttpURI class used directly;

2. The Jetty usage of the HttpURI class is not vulnerable.

Workaround

This vulnerability can be mitigated by not passing decoded user data as encoded URIs to any URI class/method, including HttpURI.

PoC

http://browser.check &@vulndetector.com/
http://browser.check #@vulndetector.com/
http://browser.check?@vulndetector.com/
http://browser.check#@vulndetector.com/
http://vulndetector.com\\/

Remediation

Upgrade org.eclipse.jetty:jetty-server to version 9.4.57.v20241219, 12.0.12 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR
• GitLab Issue

Overview

org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine.

Affected versions of this package are vulnerable to Interpretation Conflict due to inconsistent handling of invalid or unusual URIs in the parse() function on HttpURI.java‎. An attacker can bypass security controls or access restricted resources by crafting specially formatted URIs that are interpreted differently by various system components.

Remediation

Upgrade org.eclipse.jetty:jetty-server to version 12.0.31, 12.1.5 or higher.

References

• GitHub Commit
• GitHub Commit

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to HTTP Response Splitting via the Content-Disposition header when untrusted input is used to construct its value. An attacker can inject malicious characters to break the HTTP header or corrupt the framing of an outbound multipart body by supplying specially crafted file names or values.

Note: This is only exploitable if the application uses non-default or legacy HTTP connectors that do not reject malicious characters in header values, or if untrusted input is used to set the Content-Disposition of a part in an outbound multipart request body.

Remediation

Upgrade org.springframework:spring-web to version 7.0.9 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when sending view fragments over Server-Sent Events (SSE). An attacker can cause data streams to be corrupted and potentially inject malicious information to other users by controlling the data that is streamed to clients.

Note: This is only exploitable if the application uses Spring MVC or Spring WebFlux, sends view fragments via SSE, and the attacker can control the streamed data.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade org.springframework:spring-webmvc to version 7.0.9 or higher.

References

• Spring Security Advisory

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Open Redirect in the UrlHandlerFilter process when it is configured with very broadly matching patterns. An attacker can redirect users to arbitrary external sites by crafting a specially constructed URL.

Remediation

Upgrade org.springframework:spring-webmvc to version 7.0.9 or higher.

References

• Spring Security Advisory

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Open Redirect in the UrlFileNameViewController file when it is mapped with an end-of-path and lacks a configured prefix. An attacker can redirect users to arbitrary external URLs by crafting a specially constructed request.

Remediation

Upgrade org.springframework:spring-webmvc to version 7.0.9 or higher.

References

• GitHub Commit
• Spring Security Advisory

EPL-1.0 license

LGPL-2.1 license