PT-2020-4340 · Spring · Spring Integration Framework
Published
2020-07-19
·
Updated
2022-05-12
·
CVE-2020-5413
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Spring Integration framework (affected versions not specified)
Description:
The issue is related to the Kryo Codec implementations in the Spring Integration framework, which can lead to a deserialization exploit when configured with default options. This allows an attacker to execute malicious code during deserialization if the provided data contains such code. The problem arises from the resolution of unregistered classes on demand. To protect against this, configuring Kryo to require a set of trusted classes for deserialization is recommended. The vulnerability can be exploited by a remote attacker to execute arbitrary code.
Recommendations:
For all affected versions of the Spring Integration framework, configure Kryo to use a set of trusted classes for deserialization to prevent the execution of malicious code.
As a temporary workaround, consider restricting the use of the Kryo Codec implementations until a more secure configuration can be applied.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Spring Integration Framework