CVE-2023-25581 json
Deserialization of untrusted data in InternalAttributeHandler in pac4j
published 2024-10-10 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-2974 , GHSA-76mw-6p95-x9x5
- cvss
- 9.8
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
pac4j is a security framework for Java. `pac4j-core` prior to version 4.0.0 is affected by a Java deserialization vulnerability. The vulnerability affects systems that store externally controlled values in attributes of the `UserProfile` class from pac4j-core. It can be exploited by providing an attribute that contains a serialized Java object with a special prefix `{#sb64}` and Base64 encoding. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a `RestrictedObjectInputStream` is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. pac4j versions 4.0.0 and greater are not affected by this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- maven org.pac4j:pac4j-core 4.0.0
- pac4j pac4j 4.0.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.94% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.pac4j:pac4j-core | <4.0.0 |
4.0.0 |
Affected products
- pac4j pac4j
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
- securitylab.github.com /advisories/GHSL-2022-085_pac4j/
-
github.com
/frohoff/ysoserial
web
-
github.com
/pac4j/pac4j/blob/5834aeb22ad3a4369dfa572be60d7b20f5784a8f/pac4j-core/src/main/java/org/pac4j/core/profile/Int
web
-
portswigger.net
/web-security/deserialization
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-25581
advisory
-
github.com
/pac4j/pac4j
package
-
securitylab.github.com
/advisories
web
-
securitylab.github.com
/advisories/GHSL-2022-085_pac4j
advisory
Sources
- CVE List CVE-2023-25581
- GitHub Advisory GHSA-76mw-6p95-x9x5
- NVD CVE-2023-25581
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.