r/java • u/georgia15 • Nov 23 '15
Why the Java Serialization Vulnerability Makes Heartbleed Look Tame
https://dzone.com/articles/point-of-viewwhy-the-java-serialization-vulnerabil15
14
u/nuetral-developer Nov 23 '15
Is plain old Java serialization even common? I've never used it and always serialize to either xml or json.
2
u/caltheon Nov 23 '15
Maybe for saving star to disk? I think some of the messaging buses might use it, but usually those aren't open targets
23
u/curiousthis Nov 23 '15
More FUD. The actual threat level of this 'bug' is the same as the linux/windows root access ones that require local access to a server. And all this noise shows a profound level of ignorance on how classes are actually loaded by the jvm.
The JVM does not deserialize classes that it cannot access -- so this means that you cannot send it a random class for deserialization -- you'll just get a classnotfound exception if you try that. You can only deserialize a class the jvm knows about.
So in order to trigger this bug, you will need to know what classes the jvm has in its classpath, know what versions of those classes exist (the VM will refuse to deserialize a class that is a different version from that in the classpath), and know if the vm will accept a stream of bytes for deserialization.
Remember most java servers (weblogic/jboss/tomcat) are all running behind apache.
That's not to say that this is not a bug -- but it is a bug in a specific library and does not really call for this level of panic.
3
u/jbristow Nov 23 '15
What do you think of these exploits? https://github.com/frohoff/ysoserial
They're pretty scary, and the one on a standard Jenkins install makes me nervous for all the random build servers that get set up in datacenters...
https://tersesystems.com/2015/11/08/closing-the-open-door-of-java-object-serialization/
From this article, it looks like if you have ObjectInputStream in your classpath, then you're vulnerable, even if your ports are non-obvious.
6
u/curiousthis Nov 23 '15
This article gives a much better overview:
Foxglove demonstrated the attack against WebSphere via a SOAP request to the AdminService and a similar attack against JBoss via a request to the JMXInvoker service. Any javax.management port that uses remote object serialization and has vulnerable libraries is potentially vulnerable. Any server running RMI is potentially vulnerable, but if RMI ports are open to the Internet, the server has bigger security problems to worry about.
If your admin ports are open to the internet, you have other things to worry about.
0
u/jbristow Nov 23 '15
That assumes the attacker only hits you from outside.
7
u/marc2912 Nov 23 '15
If the attacker hits you from inside once again you have other things to worry about...
-1
u/jbristow Nov 23 '15
But it doesn't matter. You need to harden your systems to minimize the damage from the (now nearly inevitable) occurrence of a compromised machine.
You will be compromised. Plan accordingly.
3
u/marc2912 Nov 23 '15
You will be compromised. Plan accordingly.
I'm not sure what kind of mickey mouse operation you're working with but that's a terrible approach. Shit might as well leave the front door open then...
2
u/jbristow Nov 23 '15
You know that's not what I said. You're not designing a house, you're designing a castle. You need to plan for what happens when the thieves bring ladders and scale your walls.
Just trying to keep them out is not enough. You need to actively design your security to keep them from doing damage once they're inside.
2
u/marc2912 Nov 23 '15
I only quoted you, I could have also quoted the "now nearly inevitable". Feel free to keep downvoting me to "prove" your point...
2
u/jbristow Nov 23 '15 edited Nov 23 '15
Wait, so you don't manage your [edit: individual] servers as if the other servers in your datacenter might be compromised?
/EDIT: I haven't downvoted yet... wanting to see where this argument is headed first.
1
u/slartybartfast_ Nov 23 '15
The JVM does not deserialize classes that it cannot access
Right but the issue is that it's possible to modify the serialized data to run arbitrary Java code when the deserializer is reconstructing the objects. It's the same kind of problem with the XML encoder. The problem stems from Java being able to reconstruct any kind of object instead of only simple java bean styled objects.
The best bet is to avoid this kind of serialization and use basic JSON instead since JSON only talks about data objects.
1
u/slartybartfast_ Nov 23 '15
It seems .NET should have a similar issue. Anyone know what's their mitigation?
-7
Nov 23 '15
Wow, looks bad. Luckily, Pinn (the java multicore general intelligence) will surely design java better (being written in java).
28
u/orr94 Nov 23 '15
Total lack of details, basically just an excuse to advertise some security Java agent.