Arbitrary Command Execution

2023-12-0407:42:42

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

arbitrary command execution

remote class loading

deserialization

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.0%

JSON

org.jupiter-rpc:jupiter-serialization-kryo is vulnerable to Arbitrary Command Execution. The vulnerability is due to improper configuration which allows remote class loading. The deserialization vulnerability allows an attacker to execute arbitrary commands via crafted RPC requests.

CPENameOperatorVersion
jupiter-serialization-kryole1.3.1
jupiter-serialization-kryole1.2.17
jupiter-serialization-kryole1.2.19.Beta1
jupiter-serialization-kryole1.3.1
jupiter-serialization-kryole1.2.17
jupiter-serialization-kryole1.2.19.Beta1

Name	Operator	Version
jupiter-serialization-kryo	le	1.3.1
jupiter-serialization-kryo	le	1.2.17
jupiter-serialization-kryo	le	1.2.19.Beta1
jupiter-serialization-kryo	le	1.3.1
jupiter-serialization-kryo	le	1.2.17
jupiter-serialization-kryo	le	1.2.19.Beta1

References

github.com/advisories/GHSA-6pqx-v9g4-5hc8

github.com/fengjiachun/Jupiter

github.com/fengjiachun/Jupiter/blob/1.3.1/jupiter-serialization/jupiter-serialization-kryo/src/main/java/org/jupiter/serialization/kryo/KryoSerializer.java#L106

github.com/fengjiachun/Jupiter/issues/115

github.com/welk1n/JNDI-Injection-Exploit/releases/tag/v1.0