Vulnerability · Published Feb 24, 2020 · Assigned by GitHub_M
CVE-2020-5245Remote Code Execution (RCE) vulnerability in dropwizard-validation
High 7.9
In plain English
A high-severity injection in dropwizard-validation from dropwizard. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.dropwizard:dropwizard-validation | 1.3.19 | GHSA-3mcp-9wr4-cjqf |
| Maven | io.dropwizard:dropwizard-validation | 2.0.2 | GHSA-3mcp-9wr4-cjqf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dropwizard | dropwizard-validation | >= 1.3.0, < 1.3.19>= 2.0.0, < 2.0.2 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
References
- https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf x_refsource_CONFIRM
- https://github.com/dropwizard/dropwizard/pull/3157 x_refsource_MISC
- https://github.com/dropwizard/dropwizard/pull/3160 x_refsource_MISC
- https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236 x_refsource_MISC
- https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634 x_refsource_MISC
- https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation x_refsource_MISC
- https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions x_refsource_MISC
- https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm x_refsource_MISC