c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

Overview

Impact

The JDBC spec defines the interface DataSource, with a method called getConnection(), and ConnectionPoolDataSource, with a method called getPooledConnection(). These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselves are complicated, flexible tools which may be, and in practice sometimes have proven to be, susceptible to abuse.

Unfortunately, the JavaBean framework treats methods of this form, getXXX(), as JavaBean "properties", which JavaBean-related libraries often presume represent quick, safe-to-look-up, state or configuration.

Attackers therefore can construct malicious DataSource objects — objects whose calls to getConnection() or getPooledConnection() would trigger attacks via vulnerable JDBC drivers — and bundle them in contexts that automatically look up bean properties on deserialization. If an attacker can smuggle such an object in serialized form to a location from which an application will deserialize it, an attack is triggered.

It's not easy. It requires that a susceptible JDBC DataSource or ConnectionPoolDataSource be available on the application CLASSPATH, along with a susceptible JDBC driver, and a carrier that will automatically look up JavaBean properties on deserialization. In practice, the most common such carrier is the composition of a collection and a Comparator implementation that sorts based on JavaBean properties from Apache commons-beanutils.

But c3p0 prior to 0.14.0 offered the susceptible JDBC DataSource or ConnectionPoolDataSource, supplying an essential component of the trigger.

Patches

c3p0 versions 0.14.0 and above no longer participate in this class of attack, because they include explicit BeanInfo classes which exclude connection and pooledConnection from the list of "introspected" JavaBean properties. Since getConnection() and getPooledConnection() no longer define JavaBean properties, classes that promiscuously read JavaBean properties do not call them, and the attack is averted.

Workarounds

If users can ensure the safety of all JDBC drivers on the application CLASSPATH, or that no libraries lie on the CLASSPATH that can be composed to trigger automatic JavaBean property lookups on deserialization, then this attack is prevented. Nevertheless, given the complexity of modern JDBC drivers and typical Java application transitive dependencies, it is strongly recommended that users upgrade to c3p0 version 0.14.0 or higher.

Some versions of this attack are foiled by the stronger encapsulation and restriction of reflective access introduced in Java 16. Running applications on Java 16+ is therefore a potential mitigation.

This attack is described by Hans-Martin Münch in a blog post called "Look Mama, no TemplatesImpl".

Affected packages

• com.mchange:c3p0 < 0.14.0

Remediation

Upgrade to a patched release:

• com.mchange:c3p0 0.14.0