Bug 1499182 (CVE-2017-4995) - CVE-2017-4995 Spring Security: Deserialization of untrusted data via Jackson
Summary: CVE-2017-4995 Spring Security: Deserialization of untrusted data via Jackson
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-4995
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1499183
Blocks: 1856584
TreeView+ depends on / blocked
 
Reported: 2017-10-06 10:08 UTC by Andrej Nemec
Modified: 2021-02-17 01:26 UTC (History)
16 users (show)

Fixed In Version: springframework-security 4.2.3, springframework-security 5.0.0
Doc Type: If docs needed, set a value
Doc Text:
It was found that spring security uses Jackson's enableDefaultTyping() polymorphic capability for object deserialization. Jackson has already addressed this issue by blacklisting well-known gadget classes. However, under a right circumstances (e.g. an existence of an old JDK and vulnerable Jackson in classpath), an attacker could use this vulnerability to craft a malicious payload which would be deserialized by Jackson via spring security. This execution could potentially lead to remote code execution on the target machine.
Clone Of:
Environment:
Last Closed: 2020-07-16 01:27:36 UTC


Attachments (Terms of Use)

Description Andrej Nemec 2017-10-06 10:08:43 UTC
When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets".

Spring Security configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true:

--

Spring Security’s Jackson support is being leveraged by invoking SecurityJackson2Modules.getModules(ClassLoader) or SecurityJackson2Modules.enableDefaultTyping(ObjectMapper)

Jackson is used to deserialize data that is not trusted. Spring Security does not perform deserialization using Jackson, so this is an explicit choice of the user.

There is an unknown (Jackson is not blacklisting it already) “deserialization gadget” that allows code execution present on the classpath

--

Jackson provides a blacklisting approach to protecting against this type of attack, but Spring Security should be proactive against blocking unknown “deserialization gadgets” when Spring Security enables default typing.

External References:

https://pivotal.io/security/cve-2017-4995

References:

https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-31509

Upstream patches:

4.2.x https://github.com/spring-projects/spring-security/commit/947d11f433b78294942cb5ea56e8aa5c3a0ca439
5.x https://github.com/spring-projects/spring-security/commit/5dee8534cd1b92952d10cc56335b5d5856f48f3b

Comment 1 Andrej Nemec 2017-10-06 10:09:12 UTC
Created opendaylight tracking bugs for this issue:

Affects: openstack-rdo [bug 1499183]

Comment 4 Product Security DevOps Team 2020-07-16 01:27:36 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-4995

Comment 5 Product Security DevOps Team 2020-07-16 07:27:36 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-4995


Note You need to log in before you can comment on or make changes to this bug.