7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-6378

CVE-2023-6378: logback serialization vulnerability

A serialization vulnerability in logback receiver component part of logback allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

This is only exploitable if logback receiver component is deployed. See https://logback.qos.ch/manual/receivers.html

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-6378

CVE-2023-6378:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ch.qos.logback:logback-classic	maven	>= 1.4.0, < 1.4.12	1.4.12
ch.qos.logback:logback-core	maven	>= 1.4.0, < 1.4.12	1.4.12
ch.qos.logback:logback-classic	maven	>= 1.3.0, < 1.3.12	1.3.12
ch.qos.logback:logback-core	maven	>= 1.3.0, < 1.3.12	1.3.12
ch.qos.logback:logback-core	maven	< 1.2.13	1.2.13
ch.qos.logback:logback-classic	maven	< 1.2.13	1.2.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a deserialization issue in Logback's receiver component that can lead to Denial-of-Service. The analysis of the provided commit patches reveals two main areas of weakness that were addressed:

Specific Deserialization Flaw in LoggingEventVO: The readObject method in ch.qos.logback.classic.spi.LoggingEventVO did not validate the length of an array (argumentArray) it was deserializing. Attackers could provide an extremely large or negative length, causing excessive memory allocation or errors. The patch added explicit checks for this array length.
Lack of General Hardening in HardenedObjectInputStream: The constructors of ch.qos.logback.core.net.HardenedObjectInputStream did not, by default, apply any global filters to the ObjectInputStream to restrict properties like maximum array elements or maximum object graph depth during deserialization. This meant that even if class whitelisting was used, the structure of the serialized data itself could be exploited for DoS. The patches address this by adding a call to initObjectFilter within the constructors, which sets up an ObjectInputFilter with predefined limits.

Therefore, the vulnerable functions are identified as the readObject method of LoggingEventVO due to its missing validation, and the constructors of HardenedObjectInputStream because they previously failed to establish a sufficiently secure deserialization stream by default.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.