VYPR
← All advisories
Critical severityNVD Advisory· Published May 24, 2018· Updated Sep 16, 2024

CVE-2018-8013

CVE-2018-8013

Description

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In Apache Batik before 1.10, deserialization of AbstractDocument subclasses allows arbitrary class instantiation, leading to remote code execution.

Vulnerability

In Apache Batik versions 1.x before 1.10, the deserialization of subclasses of AbstractDocument reads a class name from the input stream and uses it to invoke the no-arg constructor via newInstance(), without proper validation [1][3]. This allows an attacker to instantiate arbitrary classes available on the classpath.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious serialized Batik document and delivering it to a vulnerable application. No authentication or user interaction is required. The attacker simply needs to supply a class name that, when instantiated, triggers malicious side effects or loads additional payloads [4].

Impact

Successful exploitation allows an attacker to instantiate arbitrary Java classes, potentially leading to remote code execution (RCE) with the privileges of the application. This results in a complete compromise of confidentiality, integrity, and availability, as reflected by a CVSS v3 base score of 9.8 (Critical) [4].

Mitigation

The vulnerability is fixed in Apache Batik version 1.10, released on 2018-05-23 [3]. Users should upgrade to Batik 1.10 or later. If upgrading is not immediately possible, avoid deserializing untrusted data with Batik's deserialization routines.

References
  1. NVD - CVE-2018-8013
  2. The Apache(tm) XML Graphics Project
  3. CVE-2018-8013 | Ubuntu

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.xmlgraphics:batikMaven
>= 1.0, < 1.101.10

Affected products

2

Patches

1
f91125b26a6c

BATIK-1222: Only call DOMImplementation in deserialization

https://github.com/apache/xmlgraphics-batikSimon SteinerMay 9, 2018via ghsa
commit
1 file changed · +7 −3
  • batik-dom/src/main/java/org/apache/batik/dom/AbstractDocument.java+7 −3 modified
    @@ -2729,9 +2729,13 @@ private void readObject(ObjectInputStream s)
             Method m = c.getMethod("getDOMImplementation", (Class[])null);
             implementation = (DOMImplementation)m.invoke(null, (Object[])null);
         } catch (Exception e) {
-            try {
-                implementation = (DOMImplementation)c.getDeclaredConstructor().newInstance();
-            } catch (Exception ex) {
+            if (DOMImplementation.class.isAssignableFrom(c)) {
+                try {
+                    implementation = (DOMImplementation)c.getDeclaredConstructor().newInstance();
+                } catch (Exception ex) {
+                }
+            } else {
+                throw new SecurityException("Trying to create object that is not a DOMImplementation.");
             }
         }
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

26

News mentions

0

No linked articles in our index yet.