提出 #911825: langchain4j langchain4j-agentic 1.18.0 Deserialization

JacksonAgenticScopeJsonCodec in the langchain4j-agentic module in LangChain4j 1.18.0 uses Jackson's activateDefaultTyping with the default LaissezFaireSubTypeValidator (via mapper.getPolymorphicTypeValidator()), which allows deserialization of arbitrary Java types. When AgenticScopeSerializer.fromJson() processes JSON data from an AgenticScopeStore, an attacker who can control the persisted JSON content can inject malicious type identifiers to instantiate arbitrary classes, leading to remote code execution via standard deserialization gadget chains such as JdbcRowSetImpl (JNDI injection).

Additional technical details: Jackson version 2.22.1. The vulnerability is equivalent to Jackson CVE-2017-7525 and CVE-2019-14379 (polymorphic deserialization with unrestricted type validation). The project's own test file (AgenticScopeJsonSerializationIT.java) contains an EvilGadget class and a test payload that directly demonstrates arbitrary class instantiation through the vulnerable codec. The LaissezFaireSubTypeValidator.validateSubType() method unconditionally returns Validity.ALLOWED, providing zero type restriction. The attack requires write access to the AgenticScopeStore persistence layer and a suitable gadget chain on the target classpath. Dynamic verification of the full JNDI injection chain has not been performed; the arbitrary class instantiation capability is confirmed through static analysis and the project's test evidence.

• ソース: ⚠️ https://github.com/afish3201-debug/CVE/blob/main/Insecure%20Jackson%20Default%20Typing%20Leads%20to%20Arbitrary%20Class%20Instantiation%20in%20LangChain4j%20Agentic%20Module.md
• ユーザー: afish (UID 82290)
• 送信: 2026年07月31日 09:36 (2 月 ago)
• モデレーション: 2026年09月25日 10:31 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 409886 [langchain4j 迄 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27 LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson 特権昇格]
• ポイント: 20