Bug 1499182 (CVE-2017-4995)

Summary: CVE-2017-4995 Spring Security: Deserialization of untrusted data via Jackson
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: apevec, chrisw, dbecker, jjoyce, jschluet, kbasil, lhh, lpeer, markmc, mburns, mkolesni, rbryant, sclewis, scohen, slinaber, tdecacqu
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: springframework-security 4.2.3, springframework-security 5.0.0 Doc Type: If docs needed, set a value
Doc Text:
It was found that spring security uses Jackson's enableDefaultTyping() polymorphic capability for object deserialization. Jackson has already addressed this issue by blacklisting well-known gadget classes. However, under a right circumstances (e.g. an existence of an old JDK and vulnerable Jackson in classpath), an attacker could use this vulnerability to craft a malicious payload which would be deserialized by Jackson via spring security. This execution could potentially lead to remote code execution on the target machine.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2020-07-16 01:27:36 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1499183    
Bug Blocks: 1856584    

Description Andrej Nemec 2017-10-06 10:08:43 UTC 
When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets".

Spring Security configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true:

--

Spring Security’s Jackson support is being leveraged by invoking SecurityJackson2Modules.getModules(ClassLoader) or SecurityJackson2Modules.enableDefaultTyping(ObjectMapper)

Jackson is used to deserialize data that is not trusted. Spring Security does not perform deserialization using Jackson, so this is an explicit choice of the user.

There is an unknown (Jackson is not blacklisting it already) “deserialization gadget” that allows code execution present on the classpath

--

Jackson provides a blacklisting approach to protecting against this type of attack, but Spring Security should be proactive against blocking unknown “deserialization gadgets” when Spring Security enables default typing.

External References:

https://pivotal.io/security/cve-2017-4995

References:

https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-31509

Upstream patches:

4.2.x https://github.com/spring-projects/spring-security/commit/947d11f433b78294942cb5ea56e8aa5c3a0ca439
5.x https://github.com/spring-projects/spring-security/commit/5dee8534cd1b92952d10cc56335b5d5856f48f3b
Comment 1 Andrej Nemec 2017-10-06 10:09:12 UTC 
Created opendaylight tracking bugs for this issue:

Affects: openstack-rdo [bug 1499183]
Comment 4 Product Security DevOps Team 2020-07-16 01:27:36 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-4995
Comment 5 Product Security DevOps Team 2020-07-16 07:27:36 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-4995