CVE-2020-9297

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code.

Netflix Titus, todas las versiones anteriores a la versión v0.1.1-rc.274, utiliza validadores de restricción personalizados de Java Bean Validation (JSR 380). Cuando se crean mensajes de error de violación de restricciones personalizadas, diferentes tipos de interpolación son compatibles, incluidas las expresiones Java EL. Si un atacante puede inyectar datos arbitrarios en la plantilla de mensaje de error que es pasada al argumento de la función ConstraintValidatorContext.buildConstraintViolationWithTemplate(), podrá ejecutar código Java arbitrario

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-02-19 CVE Reserved
2020-07-14 CVE Published
2023-03-30 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-002.md	2021-07-21

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				<= 0.1.0 Search vendor "Netflix" for product "Titus" and version " <= 0.1.0"		-		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		-		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc244		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc260		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc261		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc262		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc263		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc264		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc265		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc266		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc267		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc268		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc269		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc270		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc271		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc272		Affected
Netflix Search vendor "Netflix"		Titus Search vendor "Netflix" for product "Titus"				0.1.1 Search vendor "Netflix" for product "Titus" and version "0.1.1"		rc273		Affected