CVE-2019-10086: Insecure Deserialization in Apache Commons Beanutils
Summary
CVE-2019-10086: Insecure Deserialization in Apache Commons Beanutils. Affects commons-beanutils:commons-beanutils versions < 1.9.4. Fixed in 1.9.4. How to fix ↓
Also tracked for
- commons-beanutils · Debian:11
The same CVE-2019-10086 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Beanutils is a popular Java library that provides utility methods for manipulating Java beans. It allows developers to access and modify properties of Java objects using reflection. This vulnerability, identified as CVE-2019-10086, affects versions 1.9.2 of the library. Prior to version 1.9.4, Beanutils did not utilize the BeanIntrospector class, which could lead to insecure deserialization attacks.
Vulnerability Detail
The vulnerability arises from the lack of proper usage of the BeanIntrospector class in Apache Commons Beanutils 1.9.2. This class is designed to prevent attackers from accessing the classloader via the class property available on Java objects. However, due to oversight, this characteristic was not enabled by default in the PropertyUtilsBean. This vulnerability could allow an attacker to exploit insecure deserialization, potentially leading to remote code execution or other malicious activities.
How To Fix
Minimum fixed version
1.9.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually enable the BeanIntrospector class in the PropertyUtilsBean. This can be done by explicitly setting the 'beanIntrospector' property of the PropertyUtilsBean to an instance of BeanIntrospector. Here is an example code snippet:
PropertyUtilsBean propertyUtilsBean = new PropertyUtilsBean();
propertyUtilsBean.setBeanIntrospector(new BeanIntrospector());
Conclusion
In summary, the Apache Commons Beanutils library version 1.9.2 is vulnerable to insecure deserialization. This vulnerability can be mitigated by upgrading to version 1.9.4 or later, which includes the necessary fix. If immediate upgrade is not possible, developers can apply a temporary workaround by enabling the BeanIntrospector class. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for commons-beanutils:commons-beanutils →
FAQ
Apache Commons Beanutils is a Java library that provides utility methods for manipulating Java beans. It allows developers to access and modify properties of Java objects using reflection.
Insecure deserialization is a vulnerability that occurs when untrusted data is deserialized without proper validation. Attackers can exploit this vulnerability to execute arbitrary code, perform unauthorized actions, or cause denial of service.
This vulnerability in Apache Commons Beanutils could allow an attacker to exploit insecure deserialization, potentially leading to remote code execution or other malicious activities.
To fix this vulnerability, it is recommended to upgrade to version 1.9.4 or later of Apache Commons Beanutils. This version includes the necessary fix that enables the BeanIntrospector class by default, preventing the exploitation of insecure deserialization.
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually enable the BeanIntrospector class in the PropertyUtilsBean. This can be done by explicitly setting the 'beanIntrospector' property of the PropertyUtilsBean to an instance of BeanIntrospector.
Related vulnerabilities
Recent vulnerabilities recorded for commons-beanutils:commons-beanutils.
