You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
Environment
Jupiter version: v1.3.1
JVM version: JDK 1.8(Tested on JDK 1.8.0_65)
Preparation for Vulnerability Verification
There is an additional method named "sayObject" in the service
The application has dependencies on commons-collections and commons-beanutils.
Remote class loading is allowed (either because an old JDK version is being used(eg. 8u65 in this paper), or by using the JVM argument -Dcom.sun.jndi.ldap.object.trustURLCodebase=true)
In MessageTask.run(), as we have set the Serializer to be Kryo:
Subsequently, KryoSerializer receives the object from client and places it into deserialization without conducting any security checks:
The process then follows the CommonsBeanutils gadget:
Remediation Recommendations
1. Upgrade Kryo to Version 5.0 or Higher:
Upgrade the Kryo library to version 5.0 or a later release to benefit from the latest security enhancements and bug fixes.
2. Strict Outbound Internet Access Control
Due to the prevalence of known attack vectors leveraging JDNI injection to achieve Remote Code Execution (RCE), which requires the remote loading of malicious classes, it is recommended, where feasible without impacting business operations, to implement strict outbound internet access controls on server configurations.
3. Restriction of Access to Server
It is advisable to restrict external access to the server either by utilizing whitelist IP configurations or by closing public-facing ports. This measure aims to reduce the attack surface and potential risks associated with external access to the server.
4. Implementation of Whitelists/Blacklists for Serialization/Deserialization Classes
Establishing whitelists or blacklists for serialization/deserialization classes within the serialization protocol is recommended. This helps to restrict the deserialization of malicious classes. However, it is important to note that using a blacklist may introduce the risk of potential bypasses.
The text was updated successfully, but these errors were encountered:
Describe the Vulnerability
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
Environment
Preparation for Vulnerability Verification
There is an additional method named "sayObject" in the service
![image](https://private-user-images.githubusercontent.com/46960004/287123119-e9af3a84-a03a-488b-b9bf-a070160b69d6.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQxNzg3MjMsIm5iZiI6MTcyNDE3ODQyMywicGF0aCI6Ii80Njk2MDAwNC8yODcxMjMxMTktZTlhZjNhODQtYTAzYS00ODhiLWI5YmYtYTA3MDE2MGI2OWQ2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIwVDE4MjcwM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTg1NTU1YzIyOGExYmQ4N2MzNTVjZjVjMTJlODliMzRkZWQzMjcwNjRiMjViNDQwMzkwMDdhYTYyMDdjNjM2ZmYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.-UR5WRj1SjJ4SVq4WaJMRO18oZxs2rM3DHWhbcBB-VY)
![image](https://private-user-images.githubusercontent.com/46960004/287123191-cb0f8a1e-3d30-4c1a-929c-94454bb2ac1d.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQxNzg3MjMsIm5iZiI6MTcyNDE3ODQyMywicGF0aCI6Ii80Njk2MDAwNC8yODcxMjMxOTEtY2IwZjhhMWUtM2QzMC00YzFhLTkyOWMtOTQ0NTRiYjJhYzFkLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIwVDE4MjcwM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWYyZWFlNjEwMDJjZThmYjYzMjU1NGVhNmViNmMyNjE4NGZhOTk1MDEwNGM0MjliYmMwNDcxZjQwN2I1NTAwZTkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.CZio6A5SrqBSbGYiP09dwFpfJ_eJpvwKygkttQZ5Hbg)
The application has dependencies on commons-collections and commons-beanutils.
![image](https://private-user-images.githubusercontent.com/46960004/287123232-80b6a0ad-6b17-4a4e-b1eb-cd221d6df518.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQxNzg3MjMsIm5iZiI6MTcyNDE3ODQyMywicGF0aCI6Ii80Njk2MDAwNC8yODcxMjMyMzItODBiNmEwYWQtNmIxNy00YTRlLWIxZWItY2QyMjFkNmRmNTE4LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIwVDE4MjcwM1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWRhYzhlYzM5NTg3OTUyY2VkODQ4YWQwYTg5Njg4N2U1ZTRlNGM2YThlMjE4NGMwNjNhNmI4OWU1NjUxYWRhYjImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.5i81W4fYysqCiv6SP-2OxNzdKyDN-_Jb2dO758j3LKU)
Remote class loading is allowed (either because an old JDK version is being used(eg. 8u65 in this paper), or by using the JVM argument -Dcom.sun.jndi.ldap.object.trustURLCodebase=true)
Exploit and Analysis
POC
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "calc"
Analysis
Trigger
Remediation Recommendations
1. Upgrade Kryo to Version 5.0 or Higher:
Upgrade the Kryo library to version 5.0 or a later release to benefit from the latest security enhancements and bug fixes.
2. Strict Outbound Internet Access Control
Due to the prevalence of known attack vectors leveraging JDNI injection to achieve Remote Code Execution (RCE), which requires the remote loading of malicious classes, it is recommended, where feasible without impacting business operations, to implement strict outbound internet access controls on server configurations.
3. Restriction of Access to Server
It is advisable to restrict external access to the server either by utilizing whitelist IP configurations or by closing public-facing ports. This measure aims to reduce the attack surface and potential risks associated with external access to the server.
4. Implementation of Whitelists/Blacklists for Serialization/Deserialization Classes
Establishing whitelists or blacklists for serialization/deserialization classes within the serialization protocol is recommended. This helps to restrict the deserialization of malicious classes. However, it is important to note that using a blacklist may introduce the risk of potential bypasses.
The text was updated successfully, but these errors were encountered: