CVE-2017-4995

Severity Score

8.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets." Spring Security configures Jackson with global default typing enabled, which means that (through the previous exploit) arbitrary code could be executed if all of the following is true: (1) Spring Security's Jackson support is being leveraged by invoking SecurityJackson2Modules.getModules(ClassLoader) or SecurityJackson2Modules.enableDefaultTyping(ObjectMapper); (2) Jackson is used to deserialize data that is not trusted (Spring Security does not perform deserialization using Jackson, so this is an explicit choice of the user); and (3) there is an unknown (Jackson is not blacklisting it already) "deserialization gadget" that allows code execution present on the classpath. Jackson provides a blacklisting approach to protecting against this type of attack, but Spring Security should be proactive against blocking unknown "deserialization gadgets" when Spring Security enables default typing.

Se ha descubierto un problema en Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE y Spring Security 5.0.0.M1. Al estar configurado para habilitar la escritura por defecto, Jackson contenía una vulnerabilidad de deserialización que podría conducir a la ejecución de código arbitrario. Jackson solucionó esta vulnerabilidad poniendo los "deserialization gadgets" conocidos en una lista negra. Spring Security configura Jackson con la escritura global habilitada por defecto , lo que significa que (a través del exploit anterior) se podría ejecutar código arbitrario si lo siguiente es cierto: (1) La compatilibidad de Spring Security con Jackson se aprovecha invocando SecurityJackson2Modules.getModules(ClassLoader) o SecurityJackson2Modules.enableDefaultTyping(ObjectMapper); (2) Jackson se usa para deserializar datos no fiables (Spring Security no realiza la deserialización con Jackson, por lo que esta es una elección explícita del usuario); y (3) hay un "deserialization gadget" desconocido (Jackson aún no lo ha puesto en su lista negra) que permite la ejecución de código presente en classpath. Jackson proporciona un enfoque de listas negras para protegerse contra este tipo de ataque, pero Spring Security debería ser proactivo contra el bloqueo de "deserialization gadgets" desconocidos cuando Spring Security habilita la escritura por defecto.

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2016-12-29 CVE Reserved
2017-11-27 CVE Published
2024-08-05 CVE Updated
2024-08-13 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-502: Deserialization of Untrusted Data

CAPEC

References (5)

URL	Tag	Source
http://www.securityfocus.com/bid/99080	Broken Link
https://lists.apache.org/thread.html/4641ed8616ccc2c1fbddac2c3dc9900c96387bc226eaf0232d61909b%40%3Ccommits.cassandra.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r42ac3e39e6265db12d9fc6ae1cd4b5fea7aed9830dc6f6d58228fed7%40%3Ccommits.cassandra.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rf7f87810c38dc9abf9f93989f76008f504cbf7c1a355214640b2d04c%40%3Ccommits.cassandra.apache.org%3E	Mailing List

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://pivotal.io/security/cve-2017-4995	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Vmware Search vendor "Vmware"		Spring Security Search vendor "Vmware" for product "Spring Security"				4.2.0 Search vendor "Vmware" for product "Spring Security" and version "4.2.0"		release		Affected
Vmware Search vendor "Vmware"		Spring Security Search vendor "Vmware" for product "Spring Security"				4.2.1 Search vendor "Vmware" for product "Spring Security" and version "4.2.1"		release		Affected
Vmware Search vendor "Vmware"		Spring Security Search vendor "Vmware" for product "Spring Security"				4.2.2 Search vendor "Vmware" for product "Spring Security" and version "4.2.2"		release		Affected
Vmware Search vendor "Vmware"		Spring Security Search vendor "Vmware" for product "Spring Security"				5.0.0 Search vendor "Vmware" for product "Spring Security" and version "5.0.0"		m1		Affected