How to address some commonly flagged SCA findings?

• HttpInvokerClientIntercepter,
• HttpInvokerProxyFactoryBean, and
• SimpleHttpInvokerServiceExporter.

1. Upgrade to Spring Framework 6.x where applicable:

2. If upgrading to Spring Framework 6.x is not feasible, then verify if the application is subject to the risk of this vulnerability.
   1. Review the code and verify that the application is not using HttpInvokerServiceExporter class. Also not use the other 3 mentioned above.
   2. If you are using HttpInvokerServiceExporter class, then verify that the application does not expose those endpoints externally to untrusted clients, in particular not for unauthorized ones.
   3. Mitigate the SCA vulnerability on the Veracode platform if you have verified the proper usage:  Refer https://docs.veracode.com/r/Address_Veracode_SCA_Vulnerabilities  to understand how to propose mitigation. 
   4. Document remaining risks to avoid future usage of these vulnerable classes.

Refer: https://sca.analysiscenter.veracode.com/vulnerability-database/security/remote-code-execution-rce-/java/sid-22252/summary
NOTE: Vulnerable Methods analysis is available for this CVE. Please use Agent-based scan to determine the usage of the application.


2. Component : snakeyaml

CVE-2022-1471 (https://nvd.nist.gov/vuln/detail/CVE-2022-1471) is currently being reported with a remote code execution (RCE) issue as a critical vulnerability for the snakeyaml library versions 1.19-1.33(latest).
NVD published the record on 06/21/2024 which triggered an update on the Veracode Vulnerability Database shortly after.
Severity of this vulnerability based on CVSS level is:-
For CVSS 4.x – NA
For CVSS 3.x – 9.8 Critical (SCA reports it as V.HIGH)
For CVSS 2.x – 8.3 High. (SCA reports it as HIGH)
This SCA finding could cause your application to fail policy or go out of compliance if SCA is part of your policy criteria.

Description:
The vulnerability refers to the deserialization of yaml content using the Constructor class which does not restrict types that can lead to RCE. POC can be found here: https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2 .
If an attacker provides a payload that is able to call arbitrary Java constructors, this will also allow them to execute any command on the affected machine. Examples of Java classes that can lead to RCE with snakeyaml can be found here: https://github.com/mbechler/marshalsec/blob/master/src/main/java/marshalsec/SnakeYAML.java

Remediation:
*There was no upgrade path for the snakeyaml library to address this CVE at the time this article was initially published. As of 2023-02-26 there was a new release to address the CVE. There are a couple of options below to mitigate the risk.

1. Upgrade to snakeyaml >= v2.0 which is not backwards-compatible with v1.x.

• Reference: https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes

2. Use the SafeConstructor class when parsing untrusted content to restrict deserialization.

Yaml yaml = new Yaml(new SafeConstructor());

• Mitigate the SCA vulnerability on the Veracode platform if yaml data is considered trusted or above is implemented, Refer https://docs.veracode.com/r/Address_Veracode_SCA_Vulnerabilities  to understand how to propose a mitigation
• Document remaining risk to avoid future usage of these vulnerable classes.
• Refer: https://sca.analysiscenter.veracode.com/vulnerability-database/security/remote-code-execution-rce-/java/sid-38321/summary
• NOTE: Vulnerable Methods analysis is available for this CVE. Please use Agent-based scan to determine the usage of the application.

3.  Switch to the SnakeYaml Engine library:

• https://bitbucket.org/snakeyaml/snakeyaml-engine
• https://search.maven.org/artifact/org.snakeyaml/snakeyaml-engine