Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2020-5411— Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"

Quick assessment

Affected
Spring by VMware Spring Batch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

VMware Spring Batch是美国威睿（VMware）公司的一款用于大量数据并行处理的轻量级框架。 VMware Spring Batch 4.0.0版本至4.0.4版本、4.1.0版本至4.1.4版本和4.2.0版本至4.2.2版本中的Jackson配置存在代码问题漏洞。攻击者可利用该漏洞执行任意代码。

AI Predicted 7.5 Difficulty: Moderate EPSS 1.66% · P76
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-5411

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"
Source: CVE Program / CVE List V5
Vulnerability Description
When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true: * Spring Batch's Jackson support is being leveraged to serialize a job's ExecutionContext. * A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored). In order to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being deserialized. Spring Batch should be proactive against blocking unknown "deserialization gadgets" when enabling default typing.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
VMware Spring Batch 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware Spring Batch是美国威睿（VMware）公司的一款用于大量数据并行处理的轻量级框架。 VMware Spring Batch 4.0.0版本至4.0.4版本、4.1.0版本至4.1.4版本和4.2.0版本至4.2.2版本中的Jackson配置存在代码问题漏洞。攻击者可利用该漏洞执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Spring by VMware Spring Batch 4 ~ 4.2.3 -

II. Public POCs for CVE-2020-5411

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-5411

请登录查看更多情报信息。

Other References for CVE-2020-5411 (1)

IV. Related Vulnerabilities

Same product: Spring Batch
Same vendor: Spring by VMware
Same weakness: CWE-502

V. Comments for CVE-2020-5411

No comments yet

Leave a comment