RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-2165.
Weakness
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nuxeo | Nuxeo | 5.6.0 (including) | 5.6.0 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix01 (including) | 5.6.0-hotfix01 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix02 (including) | 5.6.0-hotfix02 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix03 (including) | 5.6.0-hotfix03 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix04 (including) | 5.6.0-hotfix04 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix05 (including) | 5.6.0-hotfix05 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix06 (including) | 5.6.0-hotfix06 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix07 (including) | 5.6.0-hotfix07 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix08 (including) | 5.6.0-hotfix08 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix09 (including) | 5.6.0-hotfix09 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix10 (including) | 5.6.0-hotfix10 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix11 (including) | 5.6.0-hotfix11 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix12 (including) | 5.6.0-hotfix12 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix13 (including) | 5.6.0-hotfix13 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix14 (including) | 5.6.0-hotfix14 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix15 (including) | 5.6.0-hotfix15 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix16 (including) | 5.6.0-hotfix16 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix17 (including) | 5.6.0-hotfix17 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix18 (including) | 5.6.0-hotfix18 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix19 (including) | 5.6.0-hotfix19 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix20 (including) | 5.6.0-hotfix20 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix21 (including) | 5.6.0-hotfix21 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix22 (including) | 5.6.0-hotfix22 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix23 (including) | 5.6.0-hotfix23 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix24 (including) | 5.6.0-hotfix24 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix25 (including) | 5.6.0-hotfix25 (including) |
| Nuxeo | Nuxeo | 5.6.0-hotfix26 (including) | 5.6.0-hotfix26 (including) |
| Nuxeo | Nuxeo | 5.8.0 (including) | 5.8.0 (including) |
Potential Mitigations
- Make fields transient to protect them from deserialization.
- An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
Related Attack Patterns
References
- http://doc.nuxeo.com/display/public/ADMINDOC58/Nuxeo+Security+Hotfixes
- https://bugzilla.redhat.com/show_bug.cgi?id=1027052
- https://github.com/nuxeo/richfaces/commit/6cbad2a6dcb70d3e33a6ce5879b1a3ad79eb1aec
- http://doc.nuxeo.com/display/public/ADMINDOC58/Nuxeo+Security+Hotfixes
- https://bugzilla.redhat.com/show_bug.cgi?id=1027052
- https://github.com/nuxeo/richfaces/commit/6cbad2a6dcb70d3e33a6ce5879b1a3ad79eb1aec