Listen to this Post
The vulnerability occurs in the Log Socket Collector of Apache Karaf Decanter. This collector listens on port 4560 without authentication. It uses Java deserialization to process incoming log data. A configuration property called “allowed classes” is intended to restrict deserialization. However, this property can be bypassed due to improper validation. Attackers can send crafted serialized data to port 4560. The data contains malicious objects that exploit deserialization. When deserialized, these objects bypass the allowed classes check. This leads to the execution of arbitrary code or resource exhaustion. The deserialization process uses ObjectInputStream without sufficient checks. Insecure deserialization practices allow unauthorized class loading. Attackers can use known deserialization gadgets in payloads. For example, payloads from tools like ysoserial can be sent. This triggers denial of service by crashing the application. The collector is not installed by default in Karaf. Only users who installed the Log Socket Collector are affected. The vulnerability stems from the socket server implementation. Incoming data is directly deserialized without authentication. The bypass allows any class to be deserialized remotely. This can lead to full application compromise or sustained DoS. Fixing requires upgrading to version 2.12.0 for proper validation.
Platform: Apache Karaf Decanter
Version: Before 2.12.0
Vulnerability: Untrusted Data Deserialization
Severity: Low
Date: Jan 26 2026
Prediction: Patched in 2.12.0
What Undercode Say:
Analytics
bash
netstat -tlnp | grep :4560
nc -zv localhost 4560
karaf@root> feature:list | grep decanter
java -cp ysoserial.jar ysoserial.GeneratePayload GadgetChain
cat << 'EOF' > exploit.ser
Serialized malicious data
EOF
python3 -c “import socket; s=socket.socket(); s.connect((‘localhost’,4560)); s.send(open(‘exploit.ser’,’rb’).read())”
code
public class VulnerableDeserialization {
private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
in.defaultReadObject(); // Bypass allowed classes
}
}
how Exploit:
Send crafted serialized data to port 4560. Bypass allowed classes property. Use deserialization gadget chains. Trigger denial of service or code execution.
Protection from this CVE
Upgrade to version 2.12.0. Disable Log Socket Collector. Implement network access controls. Use authentication for sockets.
Impact:
Denial of service possible. Remote code execution potential. Affects only installed collectors. Low severity due to non-default.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
