Remote Code Execution in Netflix Titus Due to Java Bean Validation Misconfiguration
CVE-2020-9297

9.8CRITICAL

Key Information:

Vendor

Netflix

Status
Netflix Titus
Vendor
CVE Published:
14 July 2020
đź”” Create Netflix Vulnerability Alert

What is CVE-2020-9297?

The vulnerability in Netflix Titus can be exploited through improper handling of custom constraint violation error messages generated via Java Bean Validation. Attackers can manipulate error message templates, allowing for the injection of arbitrary data. This can lead to the execution of arbitrary Java code on the server, posing significant security risks. It is essential for organizations using affected versions to apply the recommended updates to mitigate potential threats.

Affected Version(s)

Netflix Titus All versions prior to version v0.1.1-rc.274

References

https://github.com/Netflix/security-bulletins/blob/master...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-9297 : Remote Code Execution in Netflix Titus Due to Java Bean Validation Misconfiguration