Find, fix and prevent vulnerabilities in your code.

Overview

com.nimbusds:nimbus-jose-jwt is a library for JSON Web Tokens (JWT)

Affected versions of this package are vulnerable to Uncontrolled Recursion due to the improper handling JWT claim sets containing deeply nested JSON objects. An attacker can cause application downtime or resource exhaustion by submitting a specially crafted JWT with excessive nesting.

Note:

This issue only affects nimbus-jose-jwt, not Gson because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

PoC

import com.nimbusds.jwt.JWTClaimsSet;
import java.text.ParseException;
import java.util.HashMap;
import java.util.Map;

public class Test {
    // This builds a claimset with a deeply nested map, which could theoretically be supplied by a client.
    // If the JWT is serialized into JSON (for example, in logging or debugging), it can cause a StackOverflowError.
    public static void main(String[] args) throws ParseException {        
        Map<String, Object> nestedMap = new HashMap<>();
        Map<String, Object> currentLevel = nestedMap;

        for (int i = 0; i < 5000; i++) {
            Map<String, Object> nextLevel = new HashMap<>();
            currentLevel.put("", nextLevel);
            currentLevel = nextLevel;
        }

        JWTClaimsSet claimSet = JWTClaimsSet.parse(nestedMap);

        // This will cause a StackOverflowError due to excessive recursion in GSON's serialization
        claimSet.toString();
    }
}

Remediation

Upgrade com.nimbusds:nimbus-jose-jwt to version 9.37.4, 10.0.2 or higher.

References

• Bitbucket Commit
• Bitbucket Issue
• Bitbucket Issue
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due several issues in the loading of untrusted configurations. An attacker can cause excessive resource consumption by manipulating the configuration data or introducing unexpected usage patterns. Users affected by this issue are recommended to upgrade to the 2.x version line org.apache.commons:commons-configuration2, which fixes these issues.

Note: This is only exploitable if the application is configured to load untrusted configurations.

Remediation

There is no fixed version for commons-configuration:commons-configuration.

References

• Apache Mail

Overview

Affected versions of this package are vulnerable to CRLF Injection via insufficient input validation in the DefaultSmtpRequest process. An attacker can inject arbitrary SMTP commands by supplying malicious parameters containing CRLF sequences, allowing the sending of forged emails that appear to originate from a trusted server.

Remediation

Upgrade io.netty:netty-codec-smtp to version 4.2.7.Final, 4.1.128.Final or higher.

References

• GitHub Commit
• GitHub Commit

Overview

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to External Initialization of Trusted Variables or Data Stores via the conditional processing of the logback.xml configuration file when both the Janino library and Spring Framework are present on the class path. An attacker can execute arbitrary code by compromising an existing configuration file or injecting a malicious environment variable before program execution. This is only exploitable if the attacker has write access to a configuration file or can set a malicious environment variable.

Remediation

Upgrade ch.qos.logback:logback-core to version 1.5.19 or higher.

References

• GitHub Commit
• Release Notes

Overview

org.apache.httpcomponents:httpclient is a HttpClient component of the Apache HttpComponents project.

Affected versions of this package are vulnerable to Improper Input Validation. Apache HttpClient can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Remediation

Upgrade org.apache.httpcomponents:httpclient to version 4.5.13 or higher.

References

• Apache Security Advisory
• GitHub Commit
• GitHub Commit

Overview

org.springframework:spring-websocket is a framework that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the StompSubProtocolHandler module. An attacker can perform unauthorized actions on behalf of authenticated users by tricking them into submitting malicious requests.

Remediation

Upgrade org.springframework:spring-websocket to version 6.2.12 or higher.

References

• GitHub Commit
• Release Notes
• Spring Security Advisory

Dual license: EPL-1.0, LGPL-2.1

Dual license: EPL-1.0, LGPL-2.1

EPL-1.0 license