CVE-2018-21234 – CVE-2018-21234 is a critical deserialization vu... (How to Fix)

Q: What is the severity of CVE-2018-21234?

CVE-2018-21234 has a CVSS score of 9.8 (CRITICAL). CVE-2018-21234 is a critical deserialization vulnerability in Jodd JSON parser that allows remote code execution when setClassMetadataName is configured. Attackers can exploit this by sending malicious JSON data to applications using vulnerable Jodd versions. This affects any application using Jodd JSON parser with class metadata enabled.

📋 TL;DR

CVE-2018-21234 is a critical deserialization vulnerability in Jodd JSON parser that allows remote code execution when setClassMetadataName is configured. Attackers can exploit this by sending malicious JSON data to applications using vulnerable Jodd versions. This affects any application using Jodd JSON parser with class metadata enabled.

💻 Affected Systems

Products:

Jodd

Versions: All versions before 5.0.4

Operating Systems: All

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when setClassMetadataName is configured to enable class metadata in JSON parsing.

📦 What is this software?

Hive by Apache

View all CVEs affecting Hive →

Jodd by Jodd

View all CVEs affecting Jodd →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with full system compromise, allowing attackers to execute arbitrary commands, install malware, or pivot to other systems.

🟠

Likely Case

Remote code execution leading to data theft, application compromise, or server takeover.

🟢

If Mitigated

Limited impact if proper input validation and network segmentation are in place, but still significant risk.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending malicious JSON payloads to endpoints using vulnerable Jodd configuration.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 5.0.4

Vendor Advisory: https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16

Restart Required: Yes

Instructions:

1. Update Jodd dependency to version 5.0.4 or later. 2. Update pom.xml or build.gradle to use fixed version. 3. Rebuild and redeploy application. 4. Restart affected services.

🔧 Temporary Workarounds

Disable class metadata

all

Disable setClassMetadataName configuration in Jodd JSON parser

jsonParser.setClassMetadataName(null)

Input validation

all

Implement strict JSON schema validation before parsing

🧯 If You Can't Patch

Implement network segmentation to isolate vulnerable systems
Deploy web application firewall with JSON deserialization protection rules

🔍 How to Verify

Check if Vulnerable:

Check if application uses Jodd version <5.0.4 and has setClassMetadataName configured

Check Version:

Check dependency files (pom.xml, build.gradle) or runtime with: java -cp jodd.jar jodd.Version

Verify Fix Applied:

Verify Jodd version is 5.0.4 or later and class metadata is disabled or properly secured

📡 Detection & Monitoring

Log Indicators:

Unusual JSON parsing errors
Unexpected class loading in logs
Stack traces containing jodd.json.JsonParser

Network Indicators:

Malformed JSON payloads with class metadata
Unusual outbound connections from application server

SIEM Query:

source="application.logs" AND ("jodd.json.JsonParser" OR "ClassNotFoundException" OR "NoClassDefFoundError")

📊 Metadata

CVE ID: CVE-2018-21234

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: May 21, 2020

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2018-21234, you might also want to check these: