GHSA-7fm6-2qw4-g3x3

Deserialization of Untrusted Data in Pippo

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-18628

Packages

Ecosystem	Package	Affected	Fixed in
Maven	ro.pippo:pippo-core	< 1.12.0	1.12.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPO_SESSION field of a cookie. Sending this cookie may lead to remote code execution.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-18628 advisory
https://github.com/pippo-java/pippo/issues/458 web
https://github.com/pippo-java/pippo/commit/a82347d9d3358e98c89b48579d4285d807a57cc0 web
https://github.com/pippo-java/pippo/commit/c6b26551a82d2dd32097fcb17c13c3b830916296 web
https://github.com/advisories/GHSA-7fm6-2qw4-g3x3 advisory
https://github.com/pippo-java/pippo package