Class Instantiation Vulnerability in Logback Core Package
Summary
GHSA-qqpg-mvqg-649v: Logback allows an attacker to instantiate classes already present on the class path. Affects ch.qos.logback:logback-core versions < 1.5.25. Fixed in 1.5.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Logback is a popular logging framework for Java applications, designed to provide reliable and efficient logging capabilities. It is widely used due to its flexibility, performance, and ease of integration with various Java applications. The logback-core module is a critical component that handles the core functionalities of logging, including configuration and event processing. However, versions up to and including 1.5.24 have a vulnerability that allows attackers to exploit configuration files, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from an ACE (Access Control Error) in the configuration file processing of the logback-core module. An attacker can manipulate an existing logback configuration file to instantiate classes that are already present on the class path. This requires the attacker to have write access to the configuration file and for the malicious class to be present on the user's class path. The instantiation of such a class could lead to unauthorized actions within the application, although the instantiated instance may be discarded immediately after creation.
How To Fix
Minimum fixed version
1.5.25
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict write access to the logback configuration files to prevent unauthorized modifications. Additionally, review and sanitize any configuration files to ensure they do not contain references to potentially malicious classes.
Conclusion
In summary, the logback-core package has a vulnerability that allows attackers to instantiate classes through compromised configuration files. It is crucial to update to version 1.5.25 or later to mitigate this risk. Implementing access controls and using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for ch.qos.logback:logback-core →
FAQ
The CVSS score of this vulnerability is 1.8, indicating a low severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential risks include unauthorized instantiation of classes that could lead to security breaches or malicious actions within the application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing the pom.xml file.
If immediate updates are not possible, implement strict access controls on configuration files and review them for any malicious content.
References
Related vulnerabilities
Recent vulnerabilities recorded for ch.qos.logback:logback-core.
