dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution

Vulnerability

Overview

The Datadog APM client for Java, dd-trace-java, versions 0.40.0 through prior to 1.60.2, contains an unsafe deserialization vulnerability in its RMI instrumentation [1][3]. The instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters, contrary to secure coding practices for Java deserialization [1].

Exploitation

Conditions

Exploitation requires three specific conditions to be met simultaneously [1][3]. First, dd-trace-java must be attached as a Java agent (-javaagent) on a JVM running Java 16 or earlier. Second, a JMX/RMI port must be explicitly configured via -Dcom.sun.management.jmxremote.port and be network-reachable. Third, a gadget-chain-compatible library must be present on the classpath. An attacker with network access to the exposed JMX or RMI port can then send crafted serialized data to trigger deserialization [1][3].

Impact

Successful exploitation can lead to arbitrary remote code execution with the privileges of the user running the instrumented JVM [3]. This represents a critical risk, as it could allow an attacker to fully compromise the affected application and underlying system.

Mitigation

For JDK 17 and later, no action is required, but upgrading is strongly encouraged [1][3]. For JDK versions 8u121 through 16, users should upgrade to dd-trace-java version 1.60.3 or later, which applies serialization filters [2][3]. For JDK versions earlier than 8u121, where serialization filters are not available, the recommended workaround is to disable the RMI integration by setting the environment variable DD_INTEGRATION_RMI_ENABLED=false [1][3].