CVE-2017-4995

High

Published: 27/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A deserialization vulnerability was discovered in Pivotal Spring Security versions 4.2.0.RELEASE through 4.2.2.RELEASE and 5.0.0.M1, which could lead to arbitrary code execution when default typing in Jackson is enabled. The issue allows the use of unknown 'deserialization gadgets' if certain conditions are met.

Risk Assessment

Organizations may be at risk of arbitrary code execution if they use Spring Security with global default typing enabled and deserialize untrusted data. This could lead to serious security breaches.

Recommendation

It is recommended to disable default typing in Jackson configuration within Spring Security and avoid deserializing untrusted data. Additionally, updating to the latest version is advised to benefit from security fixes.

Other vulnerabilities in Pivotal Spring Security

CVE-2016-9879High
An issue was discovered in Pivotal Spring Security before version 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1 regarding the lack of consideration for URL path parameters when processing security constraints. An attacker may bypass these constraints by adding an encoded '/' parameter to a request.

Original NVD description (English source)

An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets." Spring Security configures Jackson with global default typing enabled, which means that (through the previous exploit) arbitrary code could be executed if all of the following is true: (1) Spring Security's Jackson support is being leveraged by invoking SecurityJackson2Modules.getModules(ClassLoader) or SecurityJackson2Modules.enableDefaultTyping(ObjectMapper); (2) Jackson is used to deserialize data that is not trusted (Spring Security does not perform deserialization using Jackson, so this is an explicit choice of the user); and (3) there is an unknown (Jackson is not blacklisting it already) "deserialization gadget" that allows code execution present o