[jira] [Commented] (OFBIZ-12592) Prevent possible DOS attack done using Java deserialisation

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OFBIZ-12592?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17639649#comment-17639649 ] 

ASF subversion and git services commented on OFBIZ-12592:
---------------------------------------------------------

Commit 76976bf9f03537b450af531638ac8031571ba154 in ofbiz-framework's branch refs/heads/release18.12 from Jacques Le Roux
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=76976bf9f0 ]

Fixed: Manufacturing - MRP Run Failure (OFBIZ-12716)

This was broken by
"Preventing possible DOS attack done using Java deserialisation" done with
OFBIZ-12592

The exact solution was not an easy find. Because, despite knowing that it was
related to serialization filtering (ie using
'-Djdk.serialFilter=maxarray=100000;maxdepth=20;maxrefs=500;maxbytes=500000'
in build.gradle) and suspecting that it was not related to a class because
adding an all classes allowed filter (ie *) to -Djdk.serialFilter, ie
'-Djdk.serialFilter=*;maxarray=100000;maxdepth=20;maxrefs=500;maxbytes=500000'
that did not fix the problem.

So it was, at least, one of values of the 4 other parameters initially chosen
based on default values often suggested.

With trial and error tactic, I finally found I needed only to increase maxrefs*.
I picked 1000. It should allow bigger MRP needs and should not be an issue for
DOS attacks.

* The maximum number of internal references

Note that I could have used the "Logging Filter Actions" suggestion at bottom of
https://docs.oracle.com/javase/10/core/serialization-filtering1.htm
but trial and error tactic turned to be faster.
I guess, if I refer to https://access.redhat.com/discussions/5577051, that it
could be due to using Tomcat or to OFBiz log4j2.xml setting.

Anyway Java 17 seems to have a better solution for that** and we need to turn to
it in 2023 (EOL of Java 11)

** https://inside.java/2021/03/02/monitoring-deserialization-activity-in-the-jdk

thanks: Yannong Huang for report


> Prevent possible DOS attack done using Java deserialisation
> -----------------------------------------------------------
>
>                 Key: OFBIZ-12592
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-12592
>             Project: OFBiz
>          Issue Type: Sub-task
>          Components: ALL COMPONENTS
>    Affects Versions: 18.12.06, 22.01.01
>            Reporter: Jacques Le Roux
>            Assignee: Jacques Le Roux
>            Priority: Major
>             Fix For: 18.12.06, 22.01.01
>
>
> Qing Xu, a security reporter, alerted us that, despite no current vulnerability, it could be maybe possible to do  DOS attacks using Java deserialisation. That has been fixed with https://openjdk.java.net/jeps/290 and even [implemented in Java 8|https://blogs.oracle.com/java/post/filter-incoming-serialization-data-a-little-of-jdk-9-goodness-available-now-in-current-release-families], but it needs a little effort on our side.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)