VYPR
← All advisories
Critical severityNVD Advisory· Published Oct 4, 2023· Updated Sep 19, 2024

Redisson unsafe deserialization vulnerability

CVE-2023-42809

Description

Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running in. Version 3.22.0 contains a patch for this issue.

Some post-fix advice is available. Do NOT use Kryo5Codec as deserialization codec, as it is still vulnerable to arbitrary object deserialization due to the setRegistrationRequired(false) call. On the contrary, KryoCodec is safe to use. The fix applied to SerializationCodec only consists of adding an optional allowlist of class names, even though making this behavior the default is recommended. When instantiating SerializationCodec please use the SerializationCodec(ClassLoader classLoader, Set<String> allowedClasses) constructor to restrict the allowed classes for deserialization.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.redisson:redissonMaven
< 3.22.03.22.0

Affected products

1

Patches

1
fe6a25718016

Feature - allowedClasses setting added to SerializationCodec https://github.com/redisson/redisson/security/code-scanning/4

https://github.com/redisson/redissonNikita KoksharovJun 1, 2023via ghsa
commit
2 files changed · +31 −16
  • redisson/src/main/java/org/redisson/codec/CustomObjectInputStream.java+14 −6 modified
    @@ -15,13 +15,11 @@
  */
 package org.redisson.codec;
 
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.ObjectInputStream;
-import java.io.ObjectStreamClass;
+import java.io.*;
 import java.lang.reflect.Proxy;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Set;
 
 /**
  * 
@@ -31,7 +29,14 @@
 public class CustomObjectInputStream extends ObjectInputStream {
 
     private final ClassLoader classLoader;
-    
+    private Set<String> allowedClasses;
+
+    public CustomObjectInputStream(ClassLoader classLoader, InputStream in,Set<String> allowedClasses) throws IOException {
+        super(in);
+        this.classLoader = classLoader;
+        this.allowedClasses = allowedClasses;
+    }
+
     public CustomObjectInputStream(ClassLoader classLoader, InputStream in) throws IOException {
         super(in);
         this.classLoader = classLoader;
@@ -41,6 +46,9 @@ public CustomObjectInputStream(ClassLoader classLoader, InputStream in) throws I
     protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
         try {
             String name = desc.getName();
+            if (allowedClasses != null && !allowedClasses.contains(name)) {
+                throw new InvalidClassException("Class " + name + " isn't allowed");
+            }
             return Class.forName(name, false, classLoader);
         } catch (ClassNotFoundException e) {
             return super.resolveClass(desc);
@@ -56,7 +64,7 @@ protected Class<?> resolveProxyClass(String[] interfaces) throws IOException, Cl
             loadedClasses.add(clazz);
         }
         
-        return Proxy.getProxyClass(classLoader, loadedClasses.toArray(new Class[loadedClasses.size()]));
+        return Proxy.getProxyClass(classLoader, loadedClasses.toArray(new Class[0]));
     }
     
 }
  • redisson/src/main/java/org/redisson/codec/SerializationCodec.java+17 −10 modified
    @@ -15,19 +15,19 @@
  */
 package org.redisson.codec;
 
-import java.io.IOException;
-import java.io.ObjectInputStream;
-import java.io.ObjectOutputStream;
-
+import io.netty.buffer.ByteBuf;
+import io.netty.buffer.ByteBufAllocator;
+import io.netty.buffer.ByteBufInputStream;
+import io.netty.buffer.ByteBufOutputStream;
 import org.redisson.client.codec.BaseCodec;
 import org.redisson.client.handler.State;
 import org.redisson.client.protocol.Decoder;
 import org.redisson.client.protocol.Encoder;
 
-import io.netty.buffer.ByteBuf;
-import io.netty.buffer.ByteBufAllocator;
-import io.netty.buffer.ByteBufInputStream;
-import io.netty.buffer.ByteBufOutputStream;
+import java.io.IOException;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.util.Set;
 
 /**
  * JDK's serialization codec.
@@ -51,7 +51,7 @@ public Object decode(ByteBuf buf, State state) throws IOException {
                     ObjectInputStream inputStream;
                     if (classLoader != null) {
                         Thread.currentThread().setContextClassLoader(classLoader);
-                        inputStream = new CustomObjectInputStream(classLoader, in);
+                        inputStream = new CustomObjectInputStream(classLoader, in, allowedClasses);
                     } else {
                         inputStream = new ObjectInputStream(in);
                     }
@@ -84,7 +84,8 @@ public ByteBuf encode(Object in) throws IOException {
             }
         }
     };
-    
+
+    private Set<String> allowedClasses;
     private final ClassLoader classLoader;
 
     public SerializationCodec() {
@@ -97,6 +98,12 @@ public SerializationCodec(ClassLoader classLoader) {
 
     public SerializationCodec(ClassLoader classLoader, SerializationCodec codec) {
         this.classLoader = classLoader;
+        this.allowedClasses = codec.allowedClasses;
+    }
+
+    public SerializationCodec(ClassLoader classLoader, Set<String> allowedClasses) {
+        this.classLoader = classLoader;
+        this.allowedClasses = allowedClasses;
     }
     
     @Override

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.