Guian Gumpac created TINKERPOP-3278:
---------------------------------------
Summary: Gryo IO unsafe Java deserialization
Key: TINKERPOP-3278
URL: https://issues.apache.org/jira/browse/TINKERPOP-3278
Project: TinkerPop
Issue Type: Bug
Components: io
Affects Versions: 4.0.0, 3.7.7, 3.8.2
Reporter: Guian Gumpac
Gryo registers several {{TraversalStrategy}} types (and
{{{}TraversalExplanation{}}}) with Kryo's {{{}JavaSerializer{}}}, so reading a
Gryo document deserializes attacker-controlled bytes via
{{{}ObjectInputStream.readObject(){}}}.
Affected: {{gremlin-core}} Gryo IO ({{{}GryoVersion{}}}/{{{}GryoMapper{}}}),
consumed by {{{}io(){}}}, {{{}GryoReader{}}}, {{{}GryoWriter{}}},
{{{}GryoIo{}}}, and the Hadoop Gryo IO formats. Gryo 1.0 and 3.0.
{{JavaSerializer.read()}} wraps the Kryo input in a
{{java.io.ObjectInputStream}} and calls {{{}readObject(){}}}, which
reconstructs and runs an arbitrary {{Serializable}} object graph during
decoding, before any graph-level validation. Reading a Gryo file from an
untrusted source is therefore an unsafe-deserialization sink: it can cause
denial of service and, on a classpath with a usable gadget chain, arbitrary
code execution. Gryo is not on the wire, so the surface is untrusted files and
OLAP inputs ({{{}io().read(){}}}, {{gryo}} graph persistence, Hadoop/Spark).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
