CVE-2018-18240 Pippo RCE Vulnerability

What is CVE-2018-18240?

CVE-2018-18240 is a critical unsafe deserialization vulnerability in n/a, published on 11 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.

Weakness: CWE-502

Which versions are affected by CVE-2018-18240?

4 open source packages ship an affected version, including ro.pippo:pippo-core and ro.pippo:pippo-session. It affects 1 product.

Products include Pippo Pippo.

How do I fix CVE-2018-18240?

Upgrade ro.pippo:pippo-core to 1.12.0 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2018-18240 being exploited?

There is no known exploitation of CVE-2018-18240 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-20059 Improper Restriction of XML External Entity Reference in pippo-core Critical 9.8
• CVE-2018-18628 Deserialization of Untrusted Data in Pippo Critical 9.8
• CVE-2019-5442 XML Entity Expansion in Pippo High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h892-x453-86wc.