CyberRota Analysis
AI-GeneratedApplications utilizing the Jackson2ExecutionContextStringSerializer for deserialization are at risk of a deserialization attack when processing untrusted data sources, particularly in Spring Batch versions 5.2.0 to 5.2.6 and 6.0.0 to 6.0.4. This vulnerability allows attackers to exploit the inadequate enforcement of the trusted-types allowlist in the JobParameterDeserializer, potentially leading to arbitrary code execution through crafted malicious input. Organizations using these Spring Batch versions should prioritize remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6
Related CVEs
Other vulnerabilities affecting the same vendor(s)