CVE-2020-5245: Remote Code Execution (RCE) vulnerability in dropwizard-validation
Summary
CVE-2020-5245: Remote Code Execution (RCE) vulnerability in dropwizard-validation. Affects io.dropwizard:dropwizard-validation across 2 version ranges.
>= 1.3.0-rc1, < 1.3.19
>= 2.0.0, < 2.0.2
Fixed in 1.3.19 or 2.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is dropwizard-validation, which is a library used for validation in Dropwizard applications. It provides features for validating objects and fields based on various constraints. The vulnerability affects versions before 1.3.19 and 2.0.2 of the package. The package is vulnerable to a server-side template injection in the self-validating feature, allowing attackers to inject arbitrary Java EL expressions and potentially execute remote code.
Vulnerability Detail
A server-side template injection vulnerability was discovered in the self-validating feature of dropwizard-validation. This feature, denoted by the @SelfValidating annotation, allows the injection of arbitrary Java EL expressions. Attackers can exploit this vulnerability to execute remote code on the host system with the privileges of the Dropwizard service account. The impact of this vulnerability is significant, as it allows unauthorized execution of arbitrary code on the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.3.0-rc1, < 1.3.191.3.19 -
>= 2.0.0, < 2.0.22.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not feasible, but the @SelfValidating feature is still required, it is crucial to properly sanitize any message added to the ViolationCollector in the method annotated with @SelfValidation. The following code snippet demonstrates an example of sanitizing the fullName variable:
@SelfValidation public void validateFullName(ViolationCollector col) {
if (fullName.contains("_")) {
// Sanitize fullName variable by escaping relevant characters such as "$"
col.addViolation("Full name contains invalid characters: " + sanitizeJavaEl(fullName));
}
}
Conclusion
In conclusion, the dropwizard-validation package is vulnerable to a remote code execution vulnerability in the self-validating feature. Upgrading to version 1.3.19 or 2.0.2 of the package is strongly recommended to mitigate this vulnerability. If upgrading is not possible, proper sanitization of messages added to the ViolationCollector can serve as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.dropwizard:dropwizard-validation →
FAQ
dropwizard-validation is a library used for validation in Dropwizard applications. It provides features for validating objects and fields based on various constraints.
Versions before 1.3.19 and 2.0.2 of dropwizard-validation are affected by this vulnerability.
This vulnerability allows remote code execution on the host system with the privileges of the Dropwizard service account, potentially leading to unauthorized execution of arbitrary code.
To fix this vulnerability, it is recommended to upgrade to either version 1.3.19 or 2.0.2 of dropwizard-validation, as these versions contain the necessary patches to mitigate the vulnerability.
If upgrading to the fixed versions is not feasible, but the @SelfValidating feature is still required, it is important to properly sanitize any message added to the ViolationCollector in the method annotated with @SelfValidation. See the 'workaround' section for an example.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.dropwizard:dropwizard-validation.
