PT-2023-28595 · Oracle · Java

Atorralba + 3 · Published 2023-10-04 · Updated 2024-08-05 · CVE-2023-42809

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Redisson versions prior to 3.22.0

Description The issue concerns a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers can trick clients into communicating with a malicious server, including specially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on.

Recommendations For versions prior to 3.22.0, update to version 3.22.0 to resolve the issue. As a temporary workaround, consider restricting the allowed classes for deserialization by using the SerializationCodec(ClassLoader classLoader, Set<String> allowedClasses) constructor. Avoid using the Kryo5Codec as deserialization codec, as it is still vulnerable to arbitrary object deserialization due to the setRegistrationRequired(false) call. Use KryoCodec as a safe alternative for deserialization.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-42809

GHSA-4HVC-QWR2-F8RV

Affected Products

Java

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42809.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-053_Redisson · Exploit
• https://github.com/redisson/redisson/commit/fe6a2571801656ff1599ef87bdee20f519a5d1fe · Patch
• https://osv.dev/vulnerability/GHSA-4hvc-qwr2-f8rv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42809 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42809 · Security Note
• https://github.com/redisson/redisson · Note
• https://twitter.com/cracbot/status/1710075120616984720 · Twitter Post
• https://t.me/cibsecurity/71639 · Telegram Post