CVE-2023-42809 Redisson unsafe deserialization vulnerability
Attackers can execute arbitrary code on client machines by tricking them into connecting to a malicious Redis server that sends crafted serialized objects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-42809?
CVE-2023-42809 is a critical unsafe deserialization vulnerability in redisson, published on 4 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running in. Version 3.22.0 contains a patch for this issue.
Some post-fix advice is available. Do NOT use `Kryo5Codec` as deserialization codec, as it is still vulnerable to arbitrary object deserialization due to the `setRegistrationRequired(false)` call. On the contrary, `KryoCodec` is safe to use. The fix applied to `SerializationCodec` only consists of adding an optional allowlist of class names, even though making this behavior the default is recommended. When instantiating `SerializationCodec` please use the `SerializationCodec(ClassLoader classLoader, Set<String> allowedClasses)` constructor to restrict the allowed classes for deserialization.
Weakness: CWE-502
Which versions are affected by CVE-2023-42809?
2 open source packages ship an affected version, including org.redisson:redisson. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.redisson:redisson Maven | All versions | 3.22.0 |
org.redisson:redisson Maven | All versions | 3.22.0 |
Products include Redisson Redisson.
How do I fix CVE-2023-42809?
Upgrade org.redisson:redisson to 3.22.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-42809 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-42809 exists.
Sources
Also known as GHSA-4hvc-qwr2-f8rv.