提交 #911825: langchain4j langchain4j-agentic 1.18.0 Deserialization

JacksonAgenticScopeJsonCodec in the langchain4j-agentic module in LangChain4j 1.18.0 uses Jackson's activateDefaultTyping with the default LaissezFaireSubTypeValidator (via mapper.getPolymorphicTypeValidator()), which allows deserialization of arbitrary Java types. When AgenticScopeSerializer.fromJson() processes JSON data from an AgenticScopeStore, an attacker who can control the persisted JSON content can inject malicious type identifiers to instantiate arbitrary classes, leading to remote code execution via standard deserialization gadget chains such as JdbcRowSetImpl (JNDI injection).

Additional technical details: Jackson version 2.22.1. The vulnerability is equivalent to Jackson CVE-2017-7525 and CVE-2019-14379 (polymorphic deserialization with unrestricted type validation). The project's own test file (AgenticScopeJsonSerializationIT.java) contains an EvilGadget class and a test payload that directly demonstrates arbitrary class instantiation through the vulnerable codec. The LaissezFaireSubTypeValidator.validateSubType() method unconditionally returns Validity.ALLOWED, providing zero type restriction. The attack requires write access to the AgenticScopeStore persistence layer and a suitable gadget chain on the target classpath. Dynamic verification of the full JNDI injection chain has not been performed; the arbitrary class instantiation capability is confirmed through static analysis and the project's test evidence.

• 来源: ⚠️ https://github.com/afish3201-debug/CVE/blob/main/Insecure%20Jackson%20Default%20Typing%20Leads%20to%20Arbitrary%20Class%20Instantiation%20in%20LangChain4j%20Agentic%20Module.md
• 用户: afish (UID 82290)
• 提交: 2026-07-31 09時36分 (2 月前)
• 管理: 2026-09-25 10時31分 (2 months later)
• 状态: 已接受
• VulDB条目: 409886 [langchain4j 直到 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27 LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson 权限提升]
• 积分: 20