PT-2020-20571 · Netflix+1 · Netflix Conductor+2

Published 2020-06-16 · Updated 2022-10-29 · CVE-2020-9296

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netflix Titus (affected versions not specified) Netflix Conductor (affected versions not specified)

Description The issue concerns the use of Java Bean Validation (JSR 380) custom constraint validators in Netflix Titus and Netflix Conductor. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code.

Recommendations For Netflix Titus, consider restricting access to the ConstraintValidatorContext.buildConstraintViolationWithTemplate() function to minimize the risk of exploitation. For Netflix Conductor, consider restricting access to the ConstraintValidatorContext.buildConstraintViolationWithTemplate() function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-917

Related Identifiers

CVE-2020-9296

GHSA-WFJ5-2MQR-7JVV

Affected Products

Java

Netflix Conductor

Netflix Titus

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-9296 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9296 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wfj5-2mqr-7jvv · Vendor Advisory
• https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-002.md · Note
• https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-001.md · Note