Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-24289

CVE-2022-24289: Deserialization of untrusted data in Apache Cayenne

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-24289
GHSA ID
GHSA-c58c-w527-h77p
EPSS Score
0.87441%
CWE
CWE-502
Published
2/12/2022
Updated
2/3/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.cayenne:cayenne-servermaven< 4.1.14.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability centers around unsafe Hessian deserialization in Cayenne's ROP feature. While no direct patch code is shown, the advisory explicitly mentions that patched versions (4.1.1+) introduced whitelisting for Hessian deserialization. The core vulnerable function must be the Hessian deserialization entry point, which in Java Hessian implementations is typically a deserialize() method in the serializer class. The package structure follows Cayenne's remote service implementation conventions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**ssi*n s*ri*liz*tion is * n*twork proto*ol t**t supports o*j**t-**s** tr*nsmission. *p**** **y*nn*'s option*l R*mot* O*j**t P*rsist*n** (ROP) ***tur* is * w** s*rvi**s-**s** t***nolo*y t**t provi**s o*j**t p*rsist*n** *n* qu*ry *un*tion*lity to 'r*m

Reasoning

T** vuln*r**ility **nt*rs *roun* uns*** **ssi*n **s*ri*liz*tion in **y*nn*'s ROP ***tur*. W*il* no *ir**t p*t** *o** is s*own, t** **visory *xpli*itly m*ntions t**t p*t**** v*rsions (*.*.*+) intro*u*** w*it*listin* *or **ssi*n **s*ri*liz*tion. T** *o