CVE-2020-9296: Expression Language Injection in Netflix Conductor
Summary
CVE-2020-9296: Expression Language Injection in Netflix Conductor. Affects com.netflix.conductor:conductor-core versions < 2.25.4. Fixed in 2.25.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netflix Conductor is a workflow orchestration engine developed by Netflix. It utilizes Java Bean Validation (JSR 380) custom constraint validators. These validators allow for the customization of constraint violation error messages. The error message templates support different types of interpolation, including Java EL expressions. This vulnerability arises when an attacker can inject arbitrary data into the error message template passed to the ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument. This enables the execution of arbitrary Java code.
Vulnerability Detail
The Expression Language Injection vulnerability in Netflix Conductor allows an attacker to inject arbitrary Java code by manipulating the error message template. By exploiting this vulnerability, an attacker can execute unauthorized actions, potentially leading to the compromise of sensitive data, unauthorized access, or the execution of malicious code.
How To Fix
Minimum fixed version
2.25.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of the package to mitigate the risk of exploitation.
Conclusion
The Expression Language Injection vulnerability in Netflix Conductor exposes systems to the risk of arbitrary code execution and unauthorized access. It is crucial to upgrade to the fixed version of the package (2.25.4 or later) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.netflix.conductor:conductor-core →
FAQ
Netflix Conductor is a workflow orchestration engine developed by Netflix. It provides a platform for defining, executing, and managing workflows in a distributed environment.
Expression Language Injection is a vulnerability that occurs when an application allows user-controlled data to be evaluated as code. In the case of Netflix Conductor, this vulnerability allows an attacker to inject arbitrary Java code by manipulating the error message template.
Exploiting this vulnerability can lead to unauthorized access, the execution of arbitrary code, and the compromise of sensitive data. It poses a significant risk to the security and integrity of affected systems.
Yes, upgrading to version 2.25.4 or later of the com.netflix.conductor:conductor-core package fixes this vulnerability. It is recommended to update to the latest version to ensure the security of your system.
There are no known workarounds for this vulnerability. The only effective mitigation is to upgrade to the fixed version of the package.
