CVE-2018-18628: Pippo - Deserialization of Untrusted Data
Summary
CVE-2018-18628: Deserialization of Untrusted Data in Pippo. Affects ro.pippo:pippo-core versions < 1.12.0. Fixed in 1.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pippo is a Java micro web framework that aims to be simple and lightweight. It provides a set of features for building web applications, including routing, templating, and session management. The Pippo core package (ro.pippo:pippo-core) is affected by a critical vulnerability that allows for the deserialization of untrusted data.
Vulnerability Detail
The vulnerability (CVE-2018-18628) arises from a flaw in the Pippo 1.11.0 function SerializationSessionDataTranscoder.decode(). This function utilizes ObjectInputStream.readObject() to deserialize a SessionData object without proper object type verification. An attacker can exploit this by creating a malicious object, encoding it in base64, and inserting it into the PIPPO_SESSION field of a cookie. When this cookie is sent, it can lead to remote code execution, potentially resulting in severe consequences.
How To Fix
Latest published version: 1.14.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can consider implementing their own custom session data serialization and deserialization logic, ensuring proper validation of object types. This approach can help prevent the exploitation of the vulnerability until an official fix is available. Here is an example of custom serialization and deserialization logic:
// Custom serialization
ByteArrayOutputStream bos = new ByteArrayOutputStream(); ObjectOutputStream oos = new
ObjectOutputStream(bos);
oos.writeObject(sessionData);
oos.flush();
String serializedData =
Base64.getEncoder().encodeToString(bos.toByteArray());
// Custom deserialization
byte[] decodedData =
Base64.getDecoder().decode(serializedData);
ObjectInputStream ois = new
ObjectInputStream(new ByteArrayInputStream(decodedData));
SessionData deserializedData = (SessionData) ois.readObject();
Conclusion
The Pippo core package (ro.pippo:pippo-core) is vulnerable to remote code execution due to the deserialization of untrusted data. To mitigate this critical vulnerability, it is crucial to upgrade to a version beyond 1.11.0 and ensure the fix for the deserialization issue is included. Implementing custom serialization and deserialization logic can serve as a temporary workaround. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ro.pippo:pippo-core →
FAQ
The vulnerability allows for remote code execution, which can lead to unauthorized access, data breaches, and potential compromise of the entire system.
The vulnerability affects Pippo 1.11.0. Earlier versions may also be impacted, but specific details are not available.
While specific exploits may not be publicly available, the existence of the vulnerability increases the risk of potential attacks. It is crucial to address the issue promptly.
Upgrading to a version of Pippo core beyond 1.11.0 is the recommended mitigation. Additionally, implementing custom serialization and deserialization logic can serve as a temporary workaround.
For more information about Pippo and its security, refer to the official Pippo documentation and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for ro.pippo:pippo-core.
