| शीर्षक | OpenBankProject OBP-API <=1.10.1 Deserialization of Untrusted Data |
|---|
| विवरण | OBP-API caches computed values in Redis using Twitter Chill's KryoInjection, whose default Kryo pool
(ScalaKryoInstantiator.defaultPool) has registration not required and uses Objenesis
StdInstantiatorStrategy — i.e. it will instantiate arbitrary classes found in the serialized stream,
bypassing constructors. On every cache read, the raw bytes returned by Redis GET are passed straight to
KryoInjection.invert(...).
Consequently, any party who can write the OBP Redis keyspace can achieve remote code execution in the OBP-API
JVM by planting a malicious Kryo payload (a "deserialization gadget") under a cache key that OBP later reads back.
|
|---|
| स्रोत | ⚠️ https://github.com/OpenBankProject/OBP-API/issues/2888 |
|---|
| उपयोगकर्ता | ZAST.AI (UID 87884) |
|---|
| सबमिशन | 17/08/2026 05:39 AM (1 महीना पहले) |
|---|
| संयम | 15/09/2026 10:29 AM (29 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 404073 [OpenBankProject OBP-API तक 1.10.1 Kryo Redis.scala KryoInjection.invert अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|