| Название | langchain4j langchain4j-agentic 1.18.0 Deserialization |
|---|
| Описание | JacksonAgenticScopeJsonCodec in the langchain4j-agentic module in LangChain4j 1.18.0 uses Jackson's activateDefaultTyping with the default LaissezFaireSubTypeValidator (via mapper.getPolymorphicTypeValidator()), which allows deserialization of arbitrary Java types. When AgenticScopeSerializer.fromJson() processes JSON data from an AgenticScopeStore, an attacker who can control the persisted JSON content can inject malicious type identifiers to instantiate arbitrary classes, leading to remote code execution via standard deserialization gadget chains such as JdbcRowSetImpl (JNDI injection).
Additional technical details: Jackson version 2.22.1. The vulnerability is equivalent to Jackson CVE-2017-7525 and CVE-2019-14379 (polymorphic deserialization with unrestricted type validation). The project's own test file (AgenticScopeJsonSerializationIT.java) contains an EvilGadget class and a test payload that directly demonstrates arbitrary class instantiation through the vulnerable codec. The LaissezFaireSubTypeValidator.validateSubType() method unconditionally returns Validity.ALLOWED, providing zero type restriction. The attack requires write access to the AgenticScopeStore persistence layer and a suitable gadget chain on the target classpath. Dynamic verification of the full JNDI injection chain has not been performed; the arbitrary class instantiation capability is confirmed through static analysis and the project's test evidence. |
|---|
| Источник | ⚠️ https://github.com/afish3201-debug/CVE/blob/main/Insecure%20Jackson%20Default%20Typing%20Leads%20to%20Arbitrary%20Class%20Instantiation%20in%20LangChain4j%20Agentic%20Module.md |
|---|
| Пользователь | afish (UID 82290) |
|---|
| Представление | 31.07.2026 09:36 (2 месяцы назад) |
|---|
| Модерация | 25.09.2026 10:31 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 409886 [langchain4j до 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27 LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson эскалация привилегий] |
|---|
| Баллы | 20 |
|---|