Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOracle Banking Corporate Lending Process Management
APPOracle14.2.014.3.014.5.0Oracle Banking Credit Facilities Process Management
APPOracle14.2.014.3.014.5.0Oracle Banking Supply Chain Finance
APPOracle14.2.014.3.014.5.0Oracle Banking Virtual Account Management
APPOracle14.2.014.3.014.5.0Oracle Flexcube Private Banking
APPOracle12.0.012.1.0Oracle Retail Customer Management And Segmentation Foundation
APPOracle16.0 – 19.0Oracle Retail Merchandising System
APPOracle16.0.3VMware Spring Integration
APPVmware5.3.0 – 5.3.15.2.0 – 5.2.75.1.0 – 5.1.114.3.0 – 4.3.22
Related vulnerabilities
RCE w Spring Cloud Function poprzez złośliwy SpEL routing-expression
Spring4Shell — RCE przez data binding w Spring MVC/WebFlux na JDK 9+
Apache ActiveMQ — RCE przez błędną konfigurację JMX RMIConnectorServer
Apache Camel RabbitMQ — niebezpieczna deserializacja Java (RCE)
Apache Camel Netty — niebezpieczna deserializacja Java (RCE)