CVE-2022-36944 Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization
Attackers can exploit a deserialization gadget chain in the Scala library to execute arbitrary code or modify data when used in vulnerable applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-36944?
CVE-2022-36944 is a critical unsafe deserialization vulnerability in Fedoraproject Fedora, published on 23 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
Weakness: CWE-502
Which versions are affected by CVE-2022-36944?
2 open source packages ship an affected version, including org.scala-lang:scala-library. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
org.scala-lang:scala-library Maven | From 2.13.0 | 2.13.9 |
org.scala-lang:scala-library Maven | From 2.13.0 | 2.13.9 |
Products include Fedoraproject Fedora, Scala-Lang Scala, Scala-Lang Scala-Collection-Compat.
How do I fix CVE-2022-36944?
Upgrade org.scala-lang:scala-library to 2.13.9 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-36944 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-36944 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as GHSA-8qv5-68g4-248j, ROOT-APP-MAVEN-CVE-2022-36944.