CVE-2020-11002 Remote Code Execution (RCE) vulnerability in dropwizard-validation
Attackers can execute arbitrary code via Java EL injection in self-validating beans, requiring an upgrade to the Dropwizard validation library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-11002?
CVE-2020-11002 is a high-severity code injection vulnerability in dropwizard, published on 10 Apr 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.
Weakness: CWE-74
Which versions are affected by CVE-2020-11002?
4 open source packages ship an affected version, including io.dropwizard:dropwizard-validation. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.dropwizard:dropwizard-validation Maven | All versions | 1.3.21 |
io.dropwizard:dropwizard-validation Maven | All versions | 1.3.21 |
io.dropwizard:dropwizard-validation Maven | From 2.0.0 | 2.0.3 |
io.dropwizard:dropwizard-validation Maven | From 2.0.0 | 2.0.3 |
Products include Dropwizard Dropwizard Validation.
How do I fix CVE-2020-11002?
Upgrade io.dropwizard:dropwizard-validation to a fixed version for your release line: 1.3.21 or 2.0.3.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-11002 being exploited?
There is no known exploitation of CVE-2020-11002 in the wild and no public exploit code.
Other vulnerabilities in dropwizard
Sources
Also known as GHSA-8jpx-m2wh-2v34.