pac4j-core Affected by Java Deserialization Vulnerability

CVE-2023-25581

What is CVE-2023-25581?

The pac4j-core module of the pac4j Java framework is affected by a critical Java deserialization vulnerability, identified as CVE-2023-25581. The vulnerability allows for potential remote code execution (RCE) attacks due to a flaw in the deserialization process. Systems running versions before 4.0 of pac4j-core are at risk, as an attacker could exploit the vulnerability by providing an attribute containing a serialized Java object with a special prefix and Base64 encoding. While a fix has been released in version 4.0.0, there are no known workarounds, and users are strongly advised to upgrade to the latest version to mitigate the risk. This vulnerability highlights the importance of secure coding practices and thorough validation of user-controlled data in software development.

News Articles

GBHackers

CVE-2023-25581

pac4j Java Framework Vulnerable to RCE Attacks

A critical security vulnerability has been discovered in the popular Java framework pac4j, affects versions before 4.0.

References