Find, fix and prevent vulnerabilities in your code.

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') through NioPathDeserializer in src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java. An attacker can force readValue() to resolve an attacker-controlled java.nio.file.Path URI by supplying a non-file scheme such as jar:, http:, s3:, or a custom provider scheme in untrusted JSON. That input reaches new URI(value) and then Path.of(uri), which falls back to ServiceLoader<FileSystemProvider> resolution and can invoke a matching provider’s getPath(uri) during deserialization. The result is unintended provider loading and provider-driven path handling inside the application, which can trigger denial of service or other side effects depending on what FileSystemProvider implementations are present on the classpath.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.10, 2.21.6, 2.22.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
• Maintainer's Advisory

Overview

org.codehaus.plexus:plexus-utils is a collection of various utility classes to ease working with strings, files, command lines, XML and more.

Affected versions of this package are vulnerable to Directory Traversal via the extractFile function. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade org.codehaus.plexus:plexus-utils to version 3.6.1, 4.0.3 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Gist
• GitHub Issue
• GitHub PR
• GitHub PR
• Red Hat Bugzilla Bug

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the isSafeSubType() method of DefaultBaseTypeLimitingValidator, whose denylist of unsafe base types omits java.lang.Comparable, so the method returns true for any subtype resolved under a Comparable base. An attacker can trigger instantiation of arbitrary classes that implement Comparable, such as java.io.File to reach path-traversal primitives, by sending JSON with attacker-controlled type identifiers. This requires the application to use a bare @JsonTypeInfo with the default validator and no explicit PolymorphicTypeValidator, and a property or class whose declared base type is Comparable.

Workaround

This vulnerability can be avoided by configuring an explicit restrictive PolymorphicTypeValidator, such as a BasicPolymorphicTypeValidator allowlist passed to activateDefaultTyping(), instead of relying on the default validator.

Note: The discoverer of this vulnerability reports that "I have not identified a class implementing Comparable that yields code execution purely through deserialization".

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.10, 2.21.6, 2.22.2 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub PR

LGPL-2.1 license

MPL-2.0 license