CVE-2020-5413: Code execution in Spring Integration
Summary
CVE-2020-5413: Code execution in Spring Integration. Affects org.springframework.integration:spring-integration-core across 4 version ranges.
>= 4.3.0, < 4.3.23
>= 5.1.0, < 5.1.12
>= 5.2.0, < 5.2.8
>= 5.3.0, < 5.3.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Spring Integration is a framework that provides support for building message-driven applications. It offers various features for integrating different systems and components. One of the key functionalities of Spring Integration is the Kryo Codec implementation, which allows for Java (de)serialization. However, when Kryo is configured with default options, it can lead to a vulnerability known as "deserialization gadgets" exploit. This vulnerability allows an attacker to execute malicious code during the deserialization process. To mitigate this vulnerability, Spring Integration should proactively block unknown "deserialization gadgets" by configuring Kryo to require a set of trusted classes for (de)serialization.
Vulnerability Detail
The vulnerability in Spring Integration arises from the use of Kryo Codec with default options. When unregistered classes are encountered during deserialization, they are resolved on demand, which can be exploited by an attacker to execute arbitrary code. This type of attack is known as the "deserialization gadgets" exploit. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code within the context of the application, potentially leading to unauthorized access, data breaches, or system compromise. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.0, < 4.3.234.3.23 -
>= 5.1.0, < 5.1.125.1.12 -
>= 5.2.0, < 5.2.85.2.8 -
>= 5.3.0, < 5.3.25.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is possible to configure Kryo to only allow deserialization of a predefined set of trusted classes. This can be done by explicitly registering the trusted classes with Kryo and rejecting any other unregistered classes during deserialization. Here is an example of how to configure Kryo with trusted classes:
Kryo kryo = new Kryo();
kryo.register(TrustedClass1.class);
kryo.register(TrustedClass2.class);
// Register other trusted classes
kryo.setRegistrationRequired(true);
By setting setRegistrationRequired(true), Kryo will throw an exception if an unregistered class is encountered during deserialization.
Conclusion
In conclusion, the CVE-2020-5413 vulnerability in Spring Integration allows for code execution during deserialization, which can lead to severe consequences such as unauthorized access, data breaches, or system compromise. It is crucial to update the affected versions of Spring Integration to the fixed versions and configure Kryo to require trusted classes for (de)serialization. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.integration:spring-integration-core →
FAQ
Spring Integration is a framework that provides support for building message-driven applications. It offers various features for integrating different systems and components.
The Kryo Codec is an implementation in Spring Integration that allows for Java (de)serialization. It is used for converting objects into a byte stream and vice versa.
The "deserialization gadgets" exploit is a type of attack that takes advantage of vulnerabilities in the deserialization process. It involves providing malicious data during deserialization, which can lead to the execution of arbitrary code.
This vulnerability can allow an attacker to execute arbitrary code within the context of the application. This can lead to unauthorized access, data breaches, or compromise of the entire system.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
