CVE-2018-21234: Deserialization of Untrusted Data in Jodd
Summary
CVE-2018-21234: Deserialization of Untrusted Data in Jodd. Affects org.jodd:jodd-json versions < 5.0.4. Fixed in 5.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jodd is a Java utility library that provides various functionalities for web development, including JSON processing. It is commonly used in Maven projects. The vulnerability identified as CVE-2018-21234 affects versions of Jodd prior to 5.0.4. This vulnerability arises from the improper handling of deserialization of untrusted JSON data when the 'setClassMetadataName' property is set. This can lead to remote code execution and other security risks.
Vulnerability Detail
The vulnerability in Jodd allows an attacker to exploit the deserialization process of untrusted JSON data. By manipulating the JSON payload, an attacker can inject malicious code that will be executed during the deserialization process. This can lead to various consequences, including remote code execution, unauthorized access, and data manipulation. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
5.0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can disable the 'setClassMetadataName' property if it is not required for their application. By not using this property, the vulnerability can be mitigated. However, this workaround may not be feasible in all scenarios, and it is recommended to apply the official fix by upgrading to the patched version of Jodd.
Conclusion
The vulnerability in Jodd prior to version 5.0.4 allows for the deserialization of untrusted JSON data, leading to potential remote code execution and other security risks. It is critical to upgrade to the patched version of Jodd (5.0.4 or later) to mitigate this vulnerability. Developers can also use Vulert's playground at https://vulert.com/scanner to check if their application is affected. Prompt action is recommended to ensure the security of the application.
See every vulnerability recorded for org.jodd:jodd-json →
FAQ
The vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to unauthorized access, data manipulation, and other security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your project.
While specific exploits targeting this vulnerability may exist, there are no publicly known exploits at the time of this advisory. However, it is crucial to apply the fix promptly to mitigate the risk.
As a temporary measure, you can disable the 'setClassMetadataName' property if it is not required for your application. However, it is strongly recommended to apply the official fix by upgrading to the patched version of Jodd as soon as possible.
For further support or assistance regarding vulnerability remediation, you can reach out to info@devnack.com. Our team will be happy to assist you.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
