CVE-2017-20189
📋 TL;DR
This vulnerability in Clojure allows remote code execution through deserialization of untrusted objects. Attackers can craft malicious serialized objects that execute arbitrary code when deserialized by vulnerable Clojure applications. This affects any server or application using Clojure versions before 1.9.0 that deserializes untrusted data.
💻 Affected Systems
- Clojure programming language
- Applications built with Clojure
📦 What is this software?
Clojure by Clojure
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, data exfiltration, and lateral movement within the network.
Likely Case
Server compromise leading to data theft, service disruption, or deployment of backdoors/malware.
If Mitigated
No impact if proper input validation and deserialization controls are implemented.
🎯 Exploit Status
Exploit tools like ysoserial include payloads for this vulnerability. Attack requires ability to send serialized objects to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Clojure 1.9.0 and later
Vendor Advisory: https://clojure.atlassian.net/browse/CLJ-2204
Restart Required: Yes
Instructions:
1. Update Clojure dependency to version 1.9.0 or later in your project.clj or build configuration. 2. Rebuild and redeploy your application. 3. Restart all affected services.
🔧 Temporary Workarounds
Disable unsafe deserialization
allImplement custom deserialization that validates or rejects untrusted objects
Implement custom ObjectInputStream with resolveClass() validation
Use safe serialization libraries like Kryo with proper configuration
Input validation and filtering
allValidate and sanitize all serialized data inputs before processing
Implement whitelist of allowed classes for deserialization
Use Java Security Manager with restrictive policies
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Deploy web application firewall (WAF) rules to block serialized object payloads
🔍 How to Verify
Check if Vulnerable:
Check project.clj, pom.xml, or build.gradle for Clojure version. If version < 1.9.0 and application deserializes data, it's vulnerable.Check Version:
lein deps :tree | grep clojure OR check project.clj for [org.clojure/clojure "version"]Verify Fix Applied:
Verify Clojure version is 1.9.0+ in dependencies and test deserialization functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual Java class loading errors
- Unexpected process execution from Java applications
- Stack traces containing clojure.lang classes
Network Indicators:
- Base64 encoded serialized objects in HTTP requests
- Unusual outbound connections from Java processes
SIEM Query:
source="application.logs" AND ("ClassNotFoundException" OR "InvalidClassException") AND "clojure"🔗 References
- https://clojure.atlassian.net/browse/CLJ-2204
- https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3
- https://github.com/frohoff/ysoserial/pull/68/files
- https://hackmd.io/%40fe1w0/HyefvRQKp
- https://security.snyk.io/vuln/SNYK-JAVA-ORGCLOJURE-5740378
- https://clojure.atlassian.net/browse/CLJ-2204
- https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3
- https://github.com/frohoff/ysoserial/pull/68/files
- https://hackmd.io/%40fe1w0/HyefvRQKp
- https://security.netapp.com/advisory/ntap-20241108-0002/
- https://security.snyk.io/vuln/SNYK-JAVA-ORGCLOJURE-5740378
