PT-2020-14624 · Gradle · Maven Extension Plugin

Published 2020-08-25 · Updated 2023-05-16 · CVE-2020-15777

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Maven Extension plugin versions prior to 1.6 for Gradle Enterprise

Description An issue was discovered in the Maven Extension plugin, where the extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization gadget chain. The socket is not bound exclusively to localhost and the port is randomly selected, which could potentially be used to achieve remote code execution and local privilege escalation. This issue can lead to, in the worst case, Remote Code Execution, and in the general case, local privilege escalation.

Recommendations For versions prior to 1.6, update to version 1.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the socket connection or disabling the deserialization of Java objects until a patch is available. Restrict the use of the ObjectInputStream to a list of trusted classes to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-15777

GHSA-VP55-FHXX-VCX8

Affected Products

Maven Extension Plugin

References · 6

• https://security.gradle.com/advisory/CVE-2020-15777 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15777 · Security Note
• https://docs.gradle.com/enterprise/maven-extension/#1_6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vp55-fhxx-vcx8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15777 · Vendor Advisory
• https://docs.gradle.com/enterprise/maven-extension/#release_history · Note