Author(s)
I'd like to start by saying that I'm not a security expert. I also won't link to the exploit. This is a very fresh take on a new vulnerability but there's already confirmation from Sonatype. The current exploit seems to be limited to Spring on top of Tomcat but it probably can be adapted since the underlying vulnerability seems general enough.
The vulnerability only impacts Java 9 or newer so if you have an older version you should be safe from this specific exploit.
The core problem is a regression related to an old RCE which was fixed here.
The problem is that the Java 9 module system increased the surface area. So the original fix for the RCE is no longer sufficient.
Workaround
This is actually pretty simple... Cyber Kendra included a solution and it was also mentioned by Praetorian. It seems like a prudent thing to add and I suggest you incorporate it as soon as possible!
Detection
If you have Lightrun in your servers you can instantly detect if this is exploited by placing a snapshot in the BeanWrapperImpl class as I explain in this twitter video.
-
Introducing 140 Second Ducklings: What is Debugging?
I’m launching a new Twitter video series that will focus on teaching the concepts of debugging (and other concepts) in small video bites
Read More
-
The Basics Of Breakpoints You Might Not Know
In episodes 4 and 5 of “140 Second Ducklings”, I got deeper into the more advanced underpinnings of breakpoints. There’s still a lot more to learn to move forward, but even at this stage it’s surprising how many things are …
Read More -
Debugging Tutorial: Java Return Value, IntelliJ Jump to Line and more
There are so many features in control flow and debugging. This article scratches the surface of what’s available to us. When debugging classes, we need to be aware of all the tools at our disposal.
Read More