QID 980386
QID 980386: Java (maven) Security Update for io.ratpack:ratpack-core (GHSA-hc33-32vw-rpp9)
Security update has been released for io.ratpack:ratpack-core to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
A malicious attacker can achieve Remote Code Execution (RCE) via a maliciously crafted Java deserialization gadget chain leveraged against the Ratpack session store.
If your application does not use Ratpack's session mechanism, it is not vulnerable.
Solution
Ratpack 1.9.0 introduces a strict allow-list mechanism that mitigates this vulnerability when used.Workaround:
The simplest mitigation for users of earlier versions is to reduce the likelihood of attackers being able to write to the session data store.
Alternatively or additionally, the allow-list mechanism could be manually back ported by providing an alternative implementation of `SessionSerializer` that uses an allow-list.
The simplest mitigation for users of earlier versions is to reduce the likelihood of attackers being able to write to the session data store.
Alternatively or additionally, the allow-list mechanism could be manually back ported by providing an alternative implementation of `SessionSerializer` that uses an allow-list.
Vendor References
- GHSA-hc33-32vw-rpp9 -
github.com/advisories/GHSA-hc33-32vw-rpp9
CVEs related to QID 980386
Software Advisories
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-hc33-32vw-rpp9 | io.ratpack:ratpack-core |
github.com/advisories/GHSA-hc33-32vw-rpp9 |