CVE-2019-10086

Overview

Apache Commons BeanUtils is a Java library that provides easy-to-use utilities for accessing and manipulating JavaBeans properties dynamically through reflection, simplifying tasks like copying, setting, and retrieving bean properties.

An Information Exposure vulnerability (CVE-2019-10086) has been identified in Apache Commons BeanUtils, which allows attackers to reach the class loader of the running application through the class property that every Java object exposes. PropertyUtilsBean, and therefore BeanUtilsBean, resolves property paths supplied by an application, and a path such as class.classLoader is followed like any other property. BeanUtils shipped a mechanism to hide that property, but it was not enabled by default.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects versions before 1.9.4 of Apache Commons BeanUtils, including the 1.7.x line.

‍

Details

Module Info

• Product: Apache Commons BeanUtils
• Affected packages: commons-beanutils:commons-beanutils
• Affected versions: <1.9.4
• GitHub repository: https://github.com/apache/commons-beanutils
• Published packages: https://central.sonatype.com/artifact/commons-beanutils/commons-beanutils
• Package manager: Maven
• Fixed in: NES for Apache Struts 1.7.0-commons-beanutils-1.7.1 (upstream community-supported line fixed in 1.9.4)

Vulnerability Info

This Medium-severity vulnerability is found in the commons-beanutils:commons-beanutils package in versions before 1.9.4 of Apache Commons BeanUtils. Property access goes through PropertyUtilsBean, which looks a name up with getPropertyDescriptor and invokes whatever getter it finds. Nothing in the lookup excludes the class property that comes from java.lang.Object#getClass():

// Retrieve the property getter method for the specified property
PropertyDescriptor descriptor =
        getPropertyDescriptor(bean, name);
if (descriptor == null) {
    throw new NoSuchMethodException("Unknown property '" +
            name + "'");
}
Method readMethod = getReadMethod(descriptor);

Because nested property paths are resolved one segment at a time, an attacker who controls a property name passed to PropertyUtils.getProperty, BeanUtils.getProperty, BeanUtils.populate or PropertyUtils.setProperty, for example a request parameter name in a form-binding framework, can start with class and continue through classLoader. On an affected version class.classLoader returns the application class loader, and class.classLoader.defaultAssertionStatus can be set on it. Applications that populate beans from request parameters are exposed to anyone who can send a request. Version 1.9.2 added a BeanIntrospector that hides the class property, but it had to be switched on by the application, so applications that did not opt in stayed exposed.

‍

Mitigation

Apache Commons BeanUtils 1.7.x is End-of-Life and is no longer community-supported. The affected line will not receive public updates from the community to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Apache Commons BeanUtils.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Melloware (finder)