CVE-2020-24164: Gadget chain attack in Nippy
Summary
CVE-2020-24164: Gadget chain attack in Nippy. Affects com.taoensso:nippy versions < 2.14.2. Fixed in 2.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Taoensso Nippy is a library for fast serialization and deserialization of Clojure data structures. It is commonly used in Clojure applications to efficiently store and transmit data. However, versions before 2.14.2 are vulnerable to a deserialization flaw that can be exploited by an attacker. This flaw arises from the automatic use of the Java Serializable interface, allowing an attacker to create a malicious payload that, when deserialized, can execute arbitrary code.
Vulnerability Detail
The vulnerability in Taoensso Nippy allows an attacker to craft a malicious payload that, upon deserialization, can execute arbitrary code. This can lead to various security risks, including remote code execution, privilege escalation, and data exfiltration. The flaw arises due to the automatic use of the Java Serializable interface, which can be abused by an attacker to achieve code execution. The impact of this vulnerability is high, with a CVSS score of 7.8.
How To Fix
Minimum fixed version
2.14.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of Taoensso Nippy to address the issue.
Conclusion
The deserialization flaw in Taoensso Nippy poses a significant security risk, allowing an attacker to execute arbitrary code. To mitigate this risk, it is crucial to update to version 2.14.2 or later of the library. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.taoensso:nippy →
FAQ
Taoensso Nippy is a library for fast serialization and deserialization of Clojure data structures. It is commonly used in Clojure applications to efficiently store and transmit data.
The vulnerability allows an attacker to execute arbitrary code, leading to risks such as remote code execution, privilege escalation, and data exfiltration.
To fix this vulnerability, it is recommended to upgrade to version 2.14.2 or later of Taoensso Nippy.
No, there is no known workaround for this vulnerability. Updating to the fixed version is necessary.
The CVSS score of this vulnerability is 7.8, indicating a high severity.
