Java: CodeQL query for unsafe RMI deserialization - Githubissues

github / securitylab

Resources related to GitHub Security Lab

https://securitylab.github.com

MIT License

1.41k stars 245 forks source link

Java: CodeQL query for unsafe RMI deserialization #358

Closed artem-smotrakov closed 3 years ago

artem-smotrakov commented 3 years ago

Query

https://github.com/github/codeql/pull/5818

CVE ID(s)

Report

RMI uses the default Java serialization mechanism (in other words, ObjectInputStream) to pass parameters in remote method invocations. If a remote method accepts complex parameters, then a remote attacker can send a malicious serialized object as one of the parameters. The malicious object gets deserialized without any check on the incoming data. In the worst case, it may let the attacker run arbitrary code remotely.

You can find more details about this attack in the following articles:

I'd like to propose a new experimental query that looks for deserialization vulnerabilities in remote objects registered in am RMI registry.

[x] Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing

~I am planning to write a blog post about detecting such issues.~

I wrote a short blog post about the query.

Result(s)

ghsecuritylab commented 3 years ago

Your submission is now in status SecLab review.

For information, the evaluation workflow is the following: CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

ghsecuritylab commented 3 years ago

Your submission is now in status CodeQL review.

For information, the evaluation workflow is the following: CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

artem-smotrakov commented 3 years ago

FYI I wrote a short blog post about the query.

ghsecuritylab commented 3 years ago

Your submission is now in status SecLab finalize.

For information, the evaluation workflow is the following: SecLab review > FP Check > CodeQL review > SecLab finalize > Pay > Closed

ghsecuritylab commented 3 years ago

Your submission is now in status Pay.

For information, the evaluation workflow is the following: SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed

xcorail commented 3 years ago

Created Hackerone report 1241579 for bounty 313175 : [358] Java: CodeQL query for unsafe RMI deserialization

ghsecuritylab commented 3 years ago

Your submission is now in status Closed.

For information, the evaluation workflow is the following: SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed