Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jdereg/json-io
master @ 6816167
3
Fixes
1
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
src/main/java/com/cedarsoftware/util/io/MetaUtils.java: most-fixed (2 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: Unsafe class resolution allows attackers to load and resolve arbitrary Java classes during deserialization. If blocked class lists are bypassed, attackers can load system classes capable of system command execution or arbitrary file writes.
Deserialization: Unsafe instantiation of deserialized objects via java.lang.reflect.Constructor can allow attackers to invoke constructors of arbitrary resolved classes, bypassing business logic and executing dangerous initialization sequences.
Auth Bypass: The use of sun.misc.Unsafe by default allows object instantiation without invoking standard Java constructors, effectively bypassing constructor-level validation, access controls, and security managers.