CVE-2021-29485: Remote Code Execution Vulnerability in Session Storage
Summary
CVE-2021-29485: Remote Code Execution Vulnerability in Session Storage. Affects io.ratpack:ratpack-core versions < 1.9.0. Fixed in 1.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerable package is io.ratpack:ratpack-core, which is a core component of the Ratpack framework. Ratpack is a set of libraries and tools for building modern, asynchronous, and non-blocking web applications in Java or Kotlin. It provides a flexible and lightweight approach to building web applications, with features such as routing, handling HTTP requests, and managing session data. However, a vulnerability has been discovered in the session storage mechanism of Ratpack, which can lead to remote code execution.
Vulnerability Detail
The vulnerability allows a malicious attacker to achieve remote code execution by exploiting a Java deserialization gadget chain in the Ratpack session store. Attackers who can write to session data can craft payloads that deserialize unsafe objects, enabling them to execute arbitrary code. This is known as an 'insecure deserialization' vulnerability or 'gadget vulnerability'. The vulnerability affects applications that use Ratpack's session mechanism and store session data either server-side or client-side. To mitigate this vulnerability, Ratpack has introduced a strict allow-list mechanism that requires all serialized objects to be explicitly declared as safe.
How To Fix
Latest published version: 2.0.0-rc-1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users of earlier versions of Ratpack, reducing the likelihood of attackers being able to write to the session data store can help mitigate the vulnerability. Alternatively, an alternative implementation of SessionSerializer can be provided that uses an allow-list. However, upgrading to the latest version is the recommended solution.
Conclusion
In conclusion, the remote code execution vulnerability in the session storage mechanism of Ratpack can be mitigated by upgrading to version 1.9.0 or later and implementing the strict allow-list mechanism. It is important to take action to fix this vulnerability and prevent potential exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for io.ratpack:ratpack-core →
FAQ
The vulnerability affects versions of Ratpack prior to 1.9.0.
An insecure deserialization vulnerability occurs when untrusted data is deserialized, leading to the execution of arbitrary code. Attackers can exploit this vulnerability by crafting malicious payloads that exploit the deserialization process.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities, including this one.
There are no known public exploits of this vulnerability at the time of this report. However, it is important to patch your application to prevent potential exploitation.
Yes, the CVSS score for this vulnerability is 9.9, indicating a critical severity level.
Related vulnerabilities
Recent vulnerabilities recorded for io.ratpack:ratpack-core.
