ZDRES-232: resolveProxyClass Not Overridden – acceptMatchers Filter Bypass via java.lang.reflect.Proxy<\/p>\n
Assessment: Fully addressed.<\/p>\n
When the serialised stream contains a TC_PROXYCLASSDESC (the marker
\nfor a java.lang.reflect.Proxy ), JDK\u2019s ObjectInputStream.readProxyDesc()
\n is
\ndispatched. JDK then calls the default
\nObjectInputStream.resolveProxyClass(interfaces) implementation, which
\nperforms Class.forName(intf, false, latestUserDefinedLoader()) for EACH
\ninterface name and constructs the proxy class \u00e2\u20ac\u201d bypassing the accepted
\n classes list .<\/p>\n
ZDRES-233: Class.forName(name, initialize=true, classLoader) in
\nreadClassDescriptor Triggers Static Initialiser of Allow-Listed Classes<\/p>\n
Assessment: Fully addressed.<\/p>\n
For ANY class on the allow-list, deserialising a stream that names it triggers the class\u2019s
\n (static initialiser) BEFORE any instance is constructed. This means an
\nattacker who supplies a class name on the allow-list (e.g., the
\ndeveloper wrote accept(\u201ccom.myapp.*”) , attacker supplies
\ncom.myapp.SomeClass ) causes of SomeClass \u00e2\u20ac\u201d and many
\nreal-world classes have side-effecting static initialisers<\/p>\n
Both issues have been fixed.<\/p>\n","protected":false},"excerpt":{"rendered":"
ZDRES-232: resolveProxyClass Not Overridden – acceptMatchers Filter Bypass via java.lang.reflect.Proxy<\/p>\n
Assessment: Fully addressed.<\/p>\n
When the serialised stream contains a TC_PROXYCLASSDESC (the mar<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15436","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15436"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15436"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}