CVE-2021-29485 Remote Code Execution Vulnerability in Session Storage
Attackers can achieve remote code execution via malicious deserialization in Ratpack session stores if the session mechanism is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29485?
CVE-2021-29485 is a critical unsafe deserialization vulnerability in ratpack, published on 29 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE) via a maliciously crafted Java deserialization gadget chain leveraged against the Ratpack session store. If one's application does not use Ratpack's session mechanism, it is not vulnerable. Ratpack 1.9.0 introduces a strict allow-list mechanism that mitigates this vulnerability when used. Two possible workarounds exist. The simplest mitigation for users of earlier versions is to reduce the likelihood of attackers being able to write to the session data store. Alternatively or additionally, the allow-list mechanism could be manually back ported by providing an alternative implementation of `SessionSerializer` that uses an allow-list.
Weakness: CWE-502
Which versions are affected by CVE-2021-29485?
2 open source packages ship an affected version, including io.ratpack:ratpack-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.ratpack:ratpack-core Maven | All versions | 1.9.0 |
io.ratpack:ratpack-core Maven | All versions | 1.9.0 |
Products include Ratpack Project Ratpack.
How do I fix CVE-2021-29485?
Upgrade io.ratpack:ratpack-core to 1.9.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-29485 being exploited?
There is no known exploitation of CVE-2021-29485 in the wild and no public exploit code.
Other vulnerabilities in ratpack
- CVE-2019-17513 io.ratpack:ratpack-core vulnerable to Improper Neutralization of Special Elements in Output ('Injection')
- CVE-2021-29479 Cached redirect poisoning via X-Forwarded-Host header
- CVE-2021-29481 Client side sessions should not allow unencrypted storage
- CVE-2021-29480 Default client side session signing key is highly predictable
- CVE-2019-11808 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack
Sources
Also known as GHSA-hc33-32vw-rpp9.