https://bugzilla.redhat.com/show_bug.cgi?id=1882310
--- Comment #20 from Jonathan Christison <jochrist(a)redhat.com> ---
We disagree with the base score of
9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and instead believe the Attack
Complexity to be higher - 8.1/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability Metrics:
Attack Vector Network (AV:N) -
We agree here, Jackson-databind is commonly used by applications communicating
across the network(s) a common example would be serializing and deserializing
content for RESTful APIs, these are generally services available outside the
local network and can be routable traffic.
Attack Complexity Low (AC:L) -> Attack Complexity High (AC:H):
We disagree with the original scoring of a low attack complexity, we believe
the impact is significantly different depending on mitigating circumstances,
that is to say a successful attack depends on conditions beyond the attacker's
control, we believe those conditions are -
* `enableDefaultTyping()` must be enabled - This by itself is a configuration
option and something we must assume is enabled for the base score, however the
vector from which data deserialized is application specific and an attacker
must invest some time in discovering what that is, in other words the
application must be written in such a way to deserialize from untrusted
sources.
* The exploit gadget
(`com.pastdev.httpcomponents.configuration.JndiConfiguration`) must be
available on the classpath, again this is application specific and is separate
from configuration, again this is another factor outside the attackers control
and they must gather knowledge about the target environment
Privileges Required None (PR:N) -
Agree here, the attacker does not need to be a privileged user eg. no login
required to exploit the base flaw.
User Interaction None (UI:N)
Agree here, there is no need for the attacker to coerce a user into performing
actions in order to exploit this vulnerability.
Scope Unchanged (S:U)
Agree here, the attacker will not be able to escape the scope of the executing
JVM solely due to this flaw
Impact Metrics:
Confidentiality High (C:H)
Agree here, upon a successful exploit an attacker can access all information
available to the executing JVM
Integrity High (I:H)
We agree here, upon a successful exploit the attacker can arbitrarily run code
(RCE) limited only by the scope of the executing JVM
Availability High (A:H)
We agree here, again as an attacker inherits the privileges of the JVM it is
possible to fully deny access to resources in the impacted component, its
possible such attacks can be persistent by means of file modification.
--
You are receiving this mail because:
You are on the CC list for the bug.