[COLLECTIONS-580] Arbitrary remote code execution with InvokerTransformer

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0, 4.0
• Fix Version/s: 3.2.2, 4.1
• Assignee: Unassigned
• Reporter: Philippe Marschall
• Created: 07/Nov/15 13:28
• Updated: 24/Jul/19 18:56
• Resolved: 21/Nov/15 10:02

Description

With InvokerTransformer serializable collections can be build that execute arbitrary Java code. sun.reflect.annotation.AnnotationInvocationHandler#readObject invokes #entrySet and #get on a deserialized collection. If you have an endpoint that accepts serialized Java objects (JMX, RMI, remote EJB, ...) you can combine the two to create arbitrary remote code execution vulnerability.

I don't know of a good fix short of removing InvokerTransformer or making it not Serializable. Both probably break existing applications.

This is not my research, but has been discovered by other people.

https://github.com/frohoff/ysoserial

http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

Issue Links

• is depended upon by: VELTOOLS-169 Upgrade or remove commons-collections compile dependency
• is duplicated by: COLLECTIONS-583 JAVA serialization vulnerability "CVE-2015-4852" in commons-collections*.jar
• is related to: HADOOP-12579 Deprecate WriteableRPCEngine
• is related to: MYFACES-4020 Update commons-collections to 3.2.2
• relates to: COLLECTIONS-721 functors.InvokerTransformer backward incompatibility bug
• relates to: IO-487 ValidatingObjectInputStream contribution - restrict which classes can be deserialized
• relates to: KARAF-4135 Upgrade commons-collections to version 3.2.2