Deserialization of Untrusted Data in Pippo

The impact of CVE-2018-18628 is severe, enabling remote code execution (RCE). An attacker can craft a malicious serialized object, base64 encode it, and embed it within a PIPPO_SESSION cookie. When a user with the vulnerable Pippo-Core version receives and processes this cookie, the deserialization process will trigger the execution of the attacker's code. This could lead to complete system compromise, data theft, or denial of service. The ease of exploitation, combined with the potential for RCE, makes this a high-priority vulnerability. This vulnerability shares similarities with other deserialization flaws where untrusted data is directly deserialized without proper validation, potentially leading to arbitrary code execution.

Applications and systems utilizing Pippo-Core versions 1.9.0 and earlier are at risk. This includes applications that rely on Pippo-Core for session management or data serialization. Shared hosting environments where multiple applications share the same Pippo-Core library are particularly vulnerable, as a compromise in one application could potentially affect others.

• java / server:

# Check for Pippo-Core versions prior to 1.12.0
find / -name "pippo-core*.jar" -print0 | xargs -0 jar -vf | grep "Created-By: 1.\[.*\]"

• generic web:

# Check for PIPPO_SESSION cookie in access logs
grep -i 'PIPPO_SESSION=' /var/log/apache2/access.log

1. 2018-10-24Disclosure

   disclosure

1. Veröffentlicht2018-10-24
2. Geändert2024-03-04
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2018-18628 is to upgrade Pippo-Core to version 1.12.0 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation on the PIPPO_SESSION cookie to prevent the injection of potentially malicious data. While not a complete solution, this can reduce the attack surface. Web application firewalls (WAFs) configured to detect and block deserialization attacks can also provide a layer of defense. Monitor application logs for unusual deserialization activity or errors related to object creation. After upgrading, confirm the fix by attempting to send a known malicious cookie and verifying that it is rejected or handled safely.