A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others
foxglovesecurity.com
A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others
1–10 of 27 posts
Re: A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others
#2Kenn White said it best: "This will get very ugly: unpatched, full remote exec on Java-based web svcs that use a popular serialization library
Re: A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others
#3The first thing I thought was "written in Java". The more straightforward headline would have been better, I think.
Re: A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others
#4[deleted]
Re: A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others
#5I had to backport a fix for a similar vulnerability in a Seam installation three years ago. The solution at the time was to limit the directories and sources from which serialized object representations could be read.
Re: A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others
#6This is very similar to the series of serialization vulnerabilities that hit the Ruby on Rails world in early 2013.
Black hats are going to have fun with this one. :-(
Re: A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others
#7The first thing I thought was "written in Java". The more straightforward headline would have been better, I think.
Not to get too pedantic, but Java need not be involved, though it will certainly be the most common language involved. Anything running on a JVM (including Clojure, Scala, JRuby, etc.) could have the vulnerability if it uses the Apache Commons Collections library, or some other library that does (which is probably a lengthy list).
Re: A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others
#8Re: A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others
#9The first thing I thought was "written in Java". The more straightforward headline would have been better, I think.
The straightforward headline would be "Security flaw in commons-collection deserialization". The anti-java snark really isn't welcome.
Re: A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others
#10The first thing I thought was "written in Java". The more straightforward headline would have been better, I think.
The straightforward headline would be "Security flaw in commons-collection deserialization". The anti-java snark really isn't welcome.
Its not really a problem with commons-collections and unfair to color it as their issue. Its like blaming the library that is part of a ROP chain for the exploit. The issue is what gets you in first, which is instantiating objects without any thought as to what they are from un-trusted sources.
Something that is called out in the Java secure coding guidelines:
http://www.oracle.com/technetwork/java/seccodeguide-139067.h...
and is something that goes way back in many languages. It seems to be a vuln pattern that keeps getting repeated sadly.