Log in Start free

Vulnerability · Published Jul 31, 2020 · Assigned by pivotal

CVE-2020-5413Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"

Critical 9.8

In plain English

A critical-severity unsafe deserialization in Spring Integration from Spring by VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.4% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)4.4%top 8.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.springframework.integration:spring-integration-core4.3.23GHSA-86qr-9vqc-pgc6
Mavenorg.springframework.integration:spring-integration-core5.3.2GHSA-86qr-9vqc-pgc6
Mavenorg.springframework.integration:spring-integration-core5.1.12GHSA-86qr-9vqc-pgc6
Mavenorg.springframework.integration:spring-integration-core5.2.8GHSA-86qr-9vqc-pgc6

Affected products (as reported)

VendorProductVersions
Spring by VMware Spring Integration 4.3 – before v4.3.23.RELEASE5.1 – before v5.1.12.RELEASE5.2 – before v5.2.8.RELEASE5.3 – before v5.3.2.RELEASE

Weakness: CWE-502

References