CVE-2025-48734:
Apache Commons Improper Access Control vulnerability
8.8
Basic Information
JavaTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| commons-beanutils:commons-beanutils | maven | >= 1.0, <= 1.10.1 | 1.11.0 |
| org.apache.commons:commons-beanutils2 | maven | >= 2.0.0-M1, < 2.0.0-M2 | 2.0.0-M2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability (CVE-2025-48734) in Apache Commons BeanUtils allows attackers to access an enum's classloader via the 'declaredClass' property, potentially leading to arbitrary code execution. This occurs when an application passes externally sourced property paths to PropertyUtilsBean.getProperty() or PropertyUtilsBean.getNestedProperty().
The commit bd20740da25b69552ddef8523beec0837297eaf9 addresses this by introducing SuppressPropertiesBeanIntrospector.SUPPRESS_DECLARING_CLASS and enabling it by default in PropertyUtilsBean.resetBeanIntrospectors(). This method configures the introspectors used by PropertyUtilsBean.
The vulnerable functions are org.apache.commons.beanutils2.PropertyUtilsBean.getProperty and org.apache.commons.beanutils2.PropertyUtilsBean.getNestedProperty. Since org.apache.commons.beanutils2.BeanUtilsBean.getProperty uses PropertyUtilsBean for property retrieval, it is also affected.
Prior to the patch, these methods would resolve the declaringClass property on enum objects. An attacker could then chain this with .classLoader (e.g., myEnum.declaringClass.classLoader) to gain access to the classloader. The patch mitigates this by ensuring that declaringClass is suppressed by default during property introspection for enums. The provided test cases in EnumDeclaringClassTest.java confirm this behavior and the effectiveness of the fix.