Base de CVEs

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

Alguns tipos de campos não higienizam adequadamente dados provenientes de fontes que não são formulários no Drupal 8.5.x antes de 8.5.11 e no Drupal 8.6.x antes de 8.6.10. Isso pode levar à execução arbitrária de código PHP em alguns casos. Um site só é afetado se uma das seguintes condições for atendida: o site tem o módulo RESTful Web Services (rest) do Drupal 8 core habilitado e permite requisições PATCH ou POST, ou o site tem outro módulo de serviços web habilitado, como JSON:API no Drupal 8, ou Services ou RESTful Web Services no Drupal 7. (Observação: o módulo Services do Drupal 7 em si não exige atualização no momento, mas você deve aplicar outras atualizações de contribuição associadas a este aviso se o Services estiver em uso.)

No Laravel Framework até 5.5.40 e de 5.6.x até 5.6.29, a execução remota de código pode ocorrer como resultado de uma chamada unserialize sobre um valor X-XSRF-TOKEN potencialmente não confiável. Isso envolve o método decrypt em Illuminate/Encryption/Encrypter.php e PendingBroadcast em gadgetchains/Laravel/RCE/3/chain.php no phpggc. O atacante precisa conhecer a chave da aplicação, o que normalmente nunca ocorreria, mas poderia acontecer se o atacante tivesse anteriormente acesso privilegiado ou tivesse concluído com sucesso um ataque anterior.