CVE-2020-5245 Remote Code Execution (RCE) vulnerability in dropwizard-validation
Attackers can execute arbitrary code via Java Expression Language injection in the self-validating feature of Dropwizard-Validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5245?
CVE-2020-5245 is a high-severity code injection vulnerability in dropwizard-validation, published on 24 Feb 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.
The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.
Weakness: CWE-74
Which versions are affected by CVE-2020-5245?
4 open source packages ship an affected version, including io.dropwizard:dropwizard-validation. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
io.dropwizard:dropwizard-validation Maven | From 1.3.0-rc1 | 1.3.19 |
io.dropwizard:dropwizard-validation Maven | From 1.3.0-rc1 | 1.3.19 |
io.dropwizard:dropwizard-validation Maven | From 2.0.0 | 2.0.2 |
io.dropwizard:dropwizard-validation Maven | From 2.0.0 | 2.0.2 |
Products include Dropwizard Dropwizard Validation, Oracle Blockchain Platform.
How do I fix CVE-2020-5245?
Upgrade io.dropwizard:dropwizard-validation to a fixed version for your release line: 1.3.19 or 2.0.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-5245 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-5245 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in dropwizard-validation
Sources
Also known as GHSA-3mcp-9wr4-cjqf.