PT-2020-20572 · Netflix · Netflix Titus

Pwntester · Published 2020-07-14 · Updated 2021-07-21 · CVE-2020-9297

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netflix Titus versions prior to v0.1.1-rc.274

Description The issue concerns the use of Java Bean Validation custom constraint validators in Netflix Titus. It allows for the injection of arbitrary data into error message templates, which can lead to the execution of arbitrary Java code if an attacker can inject data into the template passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument. This is due to the support of various interpolation types, including Java EL expressions, when building custom constraint violation error messages.

Recommendations For Netflix Titus versions prior to v0.1.1-rc.274, update to version v0.1.1-rc.274 or later to resolve the issue. As a temporary workaround, consider restricting the input data that can be injected into the error message template to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-917

Related Identifiers

CVE-2020-9297

Affected Products

Netflix Titus

References · 3

• https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-002.md · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-9297 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9297 · Vendor Advisory