JVN#54728399: TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java (Rich) vulnerable to ClassLoader manipulation

2022-11-1400:00:00

Japan Vulnerability Notes

jvn.jp

terasoluna

global framework

server framework

java

classloader manipulation

spring framework

vulnerability

input validation issue

cwe-20

arbitrary code execution

software update

workaround

affected products

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

39.8%

JSON

The past versions of TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java (Rich) are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability.
According to the developer, this vulnerability is caused by an improper input validation issue (CWE-20) in the binding mechanism of Spring MVC.

Impact

By the application processing a specially crafted file, arbitrary code may be executed with the privileges of the application.

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.
Note that, additional workarounds may be required depending on the system environment.
For more information, refer to the information provided by the developer.

Apply the Workaround
If an update cannot be applied, the developer recommends users applying the workaround.
For more information, refer to the information provided by the developer.

Products Affected

TERASOLUNA Global Framework 1.0.0 (Public review version)
TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1
According to the developer, in the case where only Controller that accepts XML format requests is defined as Bean, TERASOLUNA Server Framework for Java (Rich) is not affected by this vulnerability.