Connect with us

Hi, what are you looking for?



Remote Code Execution Flaw Found in Java App Servers

Several popular Java-based products are affected by a serious vulnerability that can be exploited by malicious actors to remotely execute arbitrary code.

Several popular Java-based products are affected by a serious vulnerability that can be exploited by malicious actors to remotely execute arbitrary code.

In a blog post published on Friday, FoxGlove Security showed how deserialization vulnerabilities in Java applications can be exploited for remote code execution via the popular Java library Apache Commons Collections.

Building on previous research from Gabriel Lawrence and Chris Frohoff of Qualcomm, FoxGlove Security researchers demonstrated how easy it would be for an attacker to exploit Java-based application servers and other products that use Apache Commons Collections, including Oracle WebLogic, IBM WebSphere, Red Hat’s JBoss, Jenkins, and OpenNMS.

FoxGlove says the library is used by many projects — a search on GitHub shows more than 1,300 results, according to the company.

While the exploits described by FoxGlove rely on Apache Commons Collection and the use of the InvokerTransformer class, Frohoff and others have pointed out that such attacks are possible not because of an actual vulnerability in the library, but due to poor coding practices.

According to researchers, applications using Apache Commons Collections are vulnerable to remote code execution due to Java deserialization flaws introduced by developers.

Serialization is a process in which an object is converted to a stream of bytes in order to store or transmit that object to memory or a file. The process in which serialized data is extracted is called deserialization and it can lead to major security issues if not handled properly. Serialization vulnerabilities were found recently by IBM in the Android operating system.

Advertisement. Scroll to continue reading.

The problem in this case appears to be that the developers of the affected applications failed to ensure that untrusted serialized data is not accepted for deserialization.

After FoxGlove published its blog post, members of the Apache Software Foundation started discussing ways to mitigate the issue in Apache Commons Collections by introducing a mechanism designed to control serialization.

Jenkins has released a mitigation script and OpenNMS has made available some simple instructions for protecting installations against potential attacks. Matthias Kaiser of Code White has also conducted research on the exploitation of deserialization vulnerabilities in Java and reported the issue to Oracle in July.

Security researcher Luca Carettoni has released a Java deserialization library designed to secure applications from untrusted input, and developer Charles Miller published a blog post to teach developers how to avoid introducing such flaws into their programs.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

IoT Security

A vulnerability affecting Dahua cameras and video recorders can be exploited by threat actors to modify a device’s system time.