CVE-2020-17532 Apache ServiceComb Yaml remote deserialization vulnerability
Authenticated users can achieve arbitrary code execution via unsafe deserialization when the handler-router component is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-17532?
CVE-2020-17532 is a high-severity unsafe deserialization vulnerability in Apache ServiceComb-Java-Chassis, published on 25 Jan 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
Which versions are affected by CVE-2020-17532?
4 open source packages ship an affected version, including org.apache.servicecomb:java-chassis. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.servicecomb:java-chassis Maven | From 1.0.0 | 1.3.2 |
org.apache.servicecomb:java-chassis Maven | From 1.0.0 | 1.3.2 |
org.apache.servicecomb:java-chassis Maven | From 2.0.0 | 2.1.5 |
org.apache.servicecomb:java-chassis Maven | From 2.0.0 | 2.1.5 |
Products include Apache Java Chassis.
How do I fix CVE-2020-17532?
Upgrade org.apache.servicecomb:java-chassis to a fixed version for your release line: 1.3.2 or 2.1.5.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-17532 being exploited?
There is no known exploitation of CVE-2020-17532 in the wild and no public exploit code.
Sources
Also known as GHSA-px4w-rcv2-6x8x.