PT-2020-4340 · Spring · Spring Integration Framework

Published

2020-07-19

·

Updated

2022-05-12

·

CVE-2020-5413

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Spring Integration framework (affected versions not specified)
Description: The issue is related to the Kryo Codec implementations in the Spring Integration framework, which can lead to a deserialization exploit when configured with default options. This allows an attacker to execute malicious code during deserialization if the provided data contains such code. The problem arises from the resolution of unregistered classes on demand. To protect against this, configuring Kryo to require a set of trusted classes for deserialization is recommended. The vulnerability can be exploited by a remote attacker to execute arbitrary code.
Recommendations: For all affected versions of the Spring Integration framework, configure Kryo to use a set of trusted classes for deserialization to prevent the execution of malicious code. As a temporary workaround, consider restricting the use of the Kryo Codec implementations until a more secure configuration can be applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2020-04842
CVE-2020-5413
GHSA-86QR-9VQC-PGC6

Affected Products

Spring Integration Framework