Quarkslab/OSTIF Scala 3 Security Audit: 9 Vulnerabilities (Deserialization/XSS/Command Injection)

Vulnerability Overview Quarkslab, in collaboration with the Open Source Technology Improvement Fund (OSTIF), conducted a security audit of Scala 3. The audit identified 9 vulnerabilities: 5 medium severity, 2 low severity, and 2 informational. Affected Components Scala 3 compiler Compilation pipeline Generated JVM bytecode Scala REPL TASTy Inspector Scala documentation generator Scala standard library (particularly collections, concurrency primitives, and other utility modules) Remediation Details 1. MEDIUM-1: within may be utilized as a deserialization gadget. - Remediation: Inspect and restrict class loading during the deserialization process. 2. MEDIUM-6: A stored XSS vulnerability exists in Scaladoc. - Remediation: Properly escape and validate user input. 3. MEDIUM-7: returns an unexpected value when called on an empty sequence. - Remediation: Add checks and handling for empty sequences. 4. MEDIUM-8: fails to catch when matching quotes. - Remediation: Implement exception handling mechanisms. 5. MEDIUM-9: enters an infinite loop when loading certain sections. - Remediation: Implement a load timeout mechanism. 6. LOW-2: A potential command injection vulnerability exists in GitHub Actions CI/CD scripts. - Remediation: Strictly validate and escape user input. 7. LOW-5: Scala-generated Java bytecode may lead to conflicts because the compiler does not verify conflicts between generated methods and user-defined methods. - Remediation: Add method name conflict detection. 8. INFO-1: Usage of a non-cryptographically secure random number generator. - Remediation: Replace with a cryptographically secure random number generator. 9. INFO-4: silently skips files located in subdirectories within a file. - Remediation: Add integrity checks for file traversal and processing. Proof of Concept (POC) Code No specific POC code or exploit code was provided in this report. Conclusion Quarkslab identified multiple vulnerabilities and implementation errors within the Scala codebase. While most of these issues require specific preconditions to be exploited, their existence still poses a security risk. Quarkslab has provided actionable recommendations and mitigation strategies to help Scala maintainers further enhance the project's robustness, ensure greater resilience in production environments, and strengthen the overall security posture of the Scala ecosystem.

Goal Reached Thanks to every supporter — we hit 100%!

Quarkslab/OSTIF Scala 3 Security Audit: 9 Vulnerabilities (Deserialization/XSS/Command Injection)