Skip to content

Commit df60268

Browse files
artem-smotrakovartem-smotrakov
committed
Split qhelp files
1 parent a78f211 commit df60268

6 files changed

+117
-159
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClass.qhelp

Lines changed: 6 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -1,82 +1,8 @@
1-
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
24
<qhelp>
3-
4-
<overview>
5-
<p>
6-
The Spring Framework provides an abstract base class <code>RemoteInvocationSerializingExporter</code>
7-
for creating remote service exporters.
8-
A Spring exporter, which is based on this class, deserializes incoming data using <code>ObjectInputStream</code>.
9-
Deserializing untrusted data is easily exploitable and in many cases allows an attacker
10-
to execute arbitrary code.
11-
</p>
12-
<p>
13-
The Spring Framework also provides two classes that extend <code>RemoteInvocationSerializingExporter</code>:
14-
<li>
15-
<code>HttpInvokerServiceExporter</code>
16-
</li>
17-
<li>
18-
<code>SimpleHttpInvokerServiceExporter</code>
19-
</li>
20-
</p>
21-
<p>
22-
These classes export specified beans as HTTP endpoints that deserialize data from an HTTP request
23-
using unsafe <code>ObjectInputStream</code>. If a remote attacker can reach such endpoints,
24-
it results in remote code execution in the worst case.
25-
</p>
26-
<p>
27-
CVE-2016-1000027 has been assigned to this issue in the Spring Framework.
28-
It is regarded as a design limitation, and can be mitigated but not fixed outright.
29-
</p>
30-
</overview>
31-
32-
<recommendation>
33-
<p>
34-
Avoid using <code>HttpInvokerServiceExporter</code>, <code>SimpleHttpInvokerServiceExporter</code>
35-
and any other exporter that is based on <code>RemoteInvocationSerializingExporter</code>.
36-
Instead, use other message formats for API endpoints (for example, JSON),
37-
but make sure that the underlying deserialization mechanism is properly configured
38-
so that deserialization attacks are not possible. If the vulnerable exporters can not be replaced,
39-
consider using global deserialization filters introduced in JEP 290.
40-
</p>
41-
</recommendation>
42-
43-
<example>
44-
<p>
45-
The following example shows how a vulnerable HTTP endpoint can be defined
46-
using <code>HttpInvokerServiceExporter</code> and Spring annotations:
47-
</p>
48-
<sample src="SpringExporterUnsafeDeserialization.java" />
49-
</example>
50-
51-
<references>
52-
<li>
53-
OWASP:
54-
<a href="https://www.owasp.org/index.php/Deserialization_of_untrusted_data">Deserialization of untrusted data</a>.
55-
</li>
56-
<li>
57-
Spring Framework API documentation:
58-
<a href="https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.html">RemoteInvocationSerializingExporter class</a>
59-
</li>
60-
<li>
61-
Spring Framework API documentation:
62-
<a href="https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.html">HttpInvokerServiceExporter class</a>
63-
</li>
64-
<li>
65-
National Vulnerability Database:
66-
<a href="https://nvd.nist.gov/vuln/detail/CVE-2016-1000027">CVE-2016-1000027</a>
67-
</li>
68-
<li>
69-
Tenable Research Advisory:
70-
<a href="https://www.tenable.com/security/research/tra-2016-20">[R2] Pivotal Spring Framework HttpInvokerServiceExporter readRemoteInvocation Method Untrusted Java Deserialization</a>
71-
</li>
72-
<li>
73-
Spring Framework bug tracker:
74-
<a href="https://github.com/spring-projects/spring-framework/issues/24434">Sonatype vulnerability CVE-2016-1000027 in Spring-web project</a>
75-
</li>
76-
<li>
77-
OpenJDK:
78-
<a href="https://openjdk.java.net/jeps/290">JEP 290: Filter Incoming Serialization Data</a>
79-
</li>
80-
</references>
81-
5+
<include src="UnsafeSpringExporterQuery.inc.qhelp" />
6+
<include src="UnsafeSpringExporterInConfigurationClassExample.inc.qhelp" />
7+
<include src="UnsafeSpringExporterReferences.inc.qhelp" />
828
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInConfigurationClassExample.inc.qhelp

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<example>
7+
<p>
8+
The following example shows how a vulnerable HTTP endpoint can be defined
9+
using <code>HttpInvokerServiceExporter</code> and Spring annotations:
10+
</p>
11+
<sample src="SpringExporterUnsafeDeserialization.java" />
12+
</example>
13+
14+
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfiguration.qhelp

Lines changed: 6 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -1,81 +1,8 @@
1-
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
24
<qhelp>
3-
4-
<overview>
5-
<p>
6-
The Spring Framework provides an abstract base class <code>RemoteInvocationSerializingExporter</code>
7-
for creating remote service exporters.
8-
A Spring exporter, which is based on this class, deserializes incoming data using <code>ObjectInputStream</code>.
9-
Deserializing untrusted data is easily exploitable and in many cases allows an attacker
10-
to execute arbitrary code.
11-
</p>
12-
<p>
13-
The Spring Framework also provides two classes that extend <code>RemoteInvocationSerializingExporter</code>:
14-
<li>
15-
<code>HttpInvokerServiceExporter</code>
16-
</li>
17-
<li>
18-
<code>SimpleHttpInvokerServiceExporter</code>
19-
</li>
20-
</p>
21-
<p>
22-
These classes export specified beans as HTTP endpoints that deserialize data from an HTTP request
23-
using unsafe <code>ObjectInputStream</code>. If a remote attacker can reach such endpoints,
24-
it results in remote code execution in the worst case.
25-
</p>
26-
<p>
27-
CVE-2016-1000027 has been assigned to this issue in the Spring Framework.
28-
It is regarded as a design limitation, and can be mitigated but not fixed outright.
29-
</p>
30-
</overview>
31-
32-
<recommendation>
33-
<p>
34-
Avoid using <code>HttpInvokerServiceExporter</code>, <code>SimpleHttpInvokerServiceExporter</code>
35-
and any other exporter that is based on <code>RemoteInvocationSerializingExporter</code>.
36-
Instead, use other message formats for API endpoints (for example, JSON),
37-
but make sure that the underlying deserialization mechanism is properly configured
38-
so that deserialization attacks are not possible. If the vulnerable exporters can not be replaced,
39-
consider using global deserialization filters introduced in JEP 290.
40-
</p>
41-
</recommendation>
42-
43-
<example>
44-
<p>
45-
The following examples shows how a vulnerable HTTP endpoint can be defined in a Spring XML config:
46-
</p>
47-
<sample src="SpringExporterUnsafeDeserialization.xml" />
48-
</example>
49-
50-
<references>
51-
<li>
52-
OWASP:
53-
<a href="https://www.owasp.org/index.php/Deserialization_of_untrusted_data">Deserialization of untrusted data</a>.
54-
</li>
55-
<li>
56-
Spring Framework API documentation:
57-
<a href="https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.html">RemoteInvocationSerializingExporter class</a>
58-
</li>
59-
<li>
60-
Spring Framework API documentation:
61-
<a href="https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.html">HttpInvokerServiceExporter class</a>
62-
</li>
63-
<li>
64-
National Vulnerability Database:
65-
<a href="https://nvd.nist.gov/vuln/detail/CVE-2016-1000027">CVE-2016-1000027</a>
66-
</li>
67-
<li>
68-
Tenable Research Advisory:
69-
<a href="https://www.tenable.com/security/research/tra-2016-20">[R2] Pivotal Spring Framework HttpInvokerServiceExporter readRemoteInvocation Method Untrusted Java Deserialization</a>
70-
</li>
71-
<li>
72-
Spring Framework bug tracker:
73-
<a href="https://github.com/spring-projects/spring-framework/issues/24434">Sonatype vulnerability CVE-2016-1000027 in Spring-web project</a>
74-
</li>
75-
<li>
76-
OpenJDK:
77-
<a href="https://openjdk.java.net/jeps/290">JEP 290: Filter Incoming Serialization Data</a>
78-
</li>
79-
</references>
80-
5+
<include src="UnsafeSpringExporterQuery.inc.qhelp" />
6+
<include src="UnsafeSpringExporterInXMLConfigurationExample.inc.qhelp" />
7+
<include src="UnsafeSpringExporterReferences.inc.qhelp" />
818
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterInXMLConfigurationExample.inc.qhelp

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<example>
7+
<p>
8+
The following examples shows how a vulnerable HTTP endpoint can be defined in a Spring XML config:
9+
</p>
10+
<sample src="SpringExporterUnsafeDeserialization.xml" />
11+
</example>
12+
13+
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterQuery.inc.qhelp

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
<p>
8+
The Spring Framework provides an abstract base class <code>RemoteInvocationSerializingExporter</code>
9+
for creating remote service exporters.
10+
A Spring exporter, which is based on this class, deserializes incoming data using <code>ObjectInputStream</code>.
11+
Deserializing untrusted data is easily exploitable and in many cases allows an attacker
12+
to execute arbitrary code.
13+
</p>
14+
<p>
15+
The Spring Framework also provides <code>HttpInvokerServiceExporter</code>
16+
and <code>SimpleHttpInvokerServiceExporter</code> classes
17+
that extend <code>RemoteInvocationSerializingExporter</code>.
18+
</p>
19+
<p>
20+
These classes export specified beans as HTTP endpoints that deserialize data from an HTTP request
21+
using unsafe <code>ObjectInputStream</code>. If a remote attacker can reach such endpoints,
22+
it results in remote code execution in the worst case.
23+
</p>
24+
<p>
25+
CVE-2016-1000027 has been assigned to this issue in the Spring Framework.
26+
It is regarded as a design limitation, and can be mitigated but not fixed outright.
27+
</p>
28+
</overview>
29+
30+
<recommendation>
31+
<p>
32+
Avoid using <code>HttpInvokerServiceExporter</code>, <code>SimpleHttpInvokerServiceExporter</code>
33+
and any other exporter that is based on <code>RemoteInvocationSerializingExporter</code>.
34+
Instead, use other message formats for API endpoints (for example, JSON),
35+
but make sure that the underlying deserialization mechanism is properly configured
36+
so that deserialization attacks are not possible. If the vulnerable exporters can not be replaced,
37+
consider using global deserialization filters introduced in JEP 290.
38+
</p>
39+
</recommendation>
40+
41+
</qhelp>

‎java/ql/src/experimental/Security/CWE/CWE-502/UnsafeSpringExporterReferences.inc.qhelp

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<references>
7+
<li>
8+
OWASP:
9+
<a href="https://www.owasp.org/index.php/Deserialization_of_untrusted_data">Deserialization of untrusted data</a>.
10+
</li>
11+
<li>
12+
Spring Framework API documentation:
13+
<a href="https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.html">RemoteInvocationSerializingExporter class</a>
14+
</li>
15+
<li>
16+
Spring Framework API documentation:
17+
<a href="https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.html">HttpInvokerServiceExporter class</a>
18+
</li>
19+
<li>
20+
National Vulnerability Database:
21+
<a href="https://nvd.nist.gov/vuln/detail/CVE-2016-1000027">CVE-2016-1000027</a>
22+
</li>
23+
<li>
24+
Tenable Research Advisory:
25+
<a href="https://www.tenable.com/security/research/tra-2016-20">[R2] Pivotal Spring Framework HttpInvokerServiceExporter readRemoteInvocation Method Untrusted Java Deserialization</a>
26+
</li>
27+
<li>
28+
Spring Framework bug tracker:
29+
<a href="https://github.com/spring-projects/spring-framework/issues/24434">Sonatype vulnerability CVE-2016-1000027 in Spring-web project</a>
30+
</li>
31+
<li>
32+
OpenJDK:
33+
<a href="https://openjdk.java.net/jeps/290">JEP 290: Filter Incoming Serialization Data</a>
34+
</li>
35+
</references>
36+
37+
</qhelp>

0 commit comments

Comments
 (0)