Emmanuel Lécharny created DIRAPI-457:
----------------------------------------
Summary: Java deserialization of server-controlled
extended-response payload
Key: DIRAPI-457
URL: https://issues.apache.org/jira/browse/DIRAPI-457
Project: Directory Client API
Issue Type: Bug
Affects Versions: 2.1.8
Reporter: Emmanuel Lécharny
Fix For: 2.1.9
An application uses _callStoredProcedure()_ against a directory server.
The server (compromised, malicious, or impersonated before *TLS*) replies with
a serialized gadget chain as the response value.
_SerializationUtils.deserialize_ instantiates the chain during _readObject_ and
executes attacker code in the client *JVM*.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
