Java deserialization vulnerability in SerializationSessionDataTranscoder.decode()

[idealzh]

To get a SessionData object from cookie,pippo base64 decode the PIPPO_SESSION,and then deserialize the decoded data(the decoded data is a serialized SessionData object);
However,ObjectInputStream.readObject() leads to a Java deserialization vulnerability.
The Apache Shiro framework used to have a similar issue(https://issues.apache.org/jira/browse/SHIRO-550).
There exists a gadget chain in jre8u20,we can generate the attack payload based on it;Here is a blog(https://www.anquanke.com/post/id/87270) about the generating procedure,I am sorry it's writed in Chinese,or get the payload by tool(https://github.com/360-A-Team/SerialWriter) ;So,if the version lowwer than jre8u20,it may leads to a remote code execution;
For details,please refer to the picture below：

The payload I used is as follows:
jre8u20payload_base64.txt
And some third party modules also have a gadget chain;
To fix the issue,we can implement a class FilteringObjectInputStream,and replace ObjectInputStream with it,The implementation of FilterObjectInputStream is as follows:

public class FilteringObjectInputStream extends ObjectInputStream {
 public FilteringObjectInputStream(InputStream in) throws IOException {
 super(in);
 }
 protected Class<?> resolveClass(java.io.ObjectStreamClass descriptor) throws ClassNotFoundException, IOException {
 String className = descriptor.getName();
 ClassFilter classFilter=new ClassFilter();
 if(className != null && className.length() > 0 && !classFilter.isWhiteListed(className)) {
 throw new InvalidClassException("Unauthorized deserialization attempt", descriptor.getName());
 } else {
 return super.resolveClass(descriptor);
 }
 }
}
public class ClassFilter {
 private ArrayList<String> WhiteList= null; 
 public ClassFilter() {
 	 WhiteList=new ArrayList<String>();
 		 WhiteList.add("ro.pippo.session.SessionData");
 		 WhiteList.add("java.util.HashMap");
 		 WhiteList.add("ro.pippo.core.Flash");
 		 WhiteList.add("java.util.ArrayList");
 }
 public boolean isWhiteListed(String className) {
 	 if(className==null) return false;
 	 for(String name:WhiteList) {
 		 if(name.equals(className)) return true;
 	 }
		 return false;
 }
}

It's just a demo.

[rygel]

There is now a CVE for this: https://nvd.nist.gov/vuln/detail/CVE-2018-18628

[decebals]

Closed by commit a82347d.