Brian Vermeer on foojay.io - Friends of OpenJDK

Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)

Fri, 15 May 2026 15:31:08 +0000

The Thymeleaf vulnerability with a CVSS score of 9.1 grabs your attention, as it should. But before you call the cavalry and claim this as the new Log4shell, read this first.

CVE-2026-40478 is a server-side template injection vulnerability in Thymeleaf discovered by pentester Dawid Bakaj . Thymeleaf is a templating engine in Java that is used for server-side webpage rendering. The sandbox that normally prevents arbitrary code execution got bypassed using a tab character. And yes, this can lead to a remote code execution if exploited.

How Chat Memory Manipulation Can Ruin Your AI System

Thu, 16 Oct 2025 10:45:59 +0000

Do LLMs have any conversational memory?

With the use of ChatGPT, Claude, and Copilot, we are now quite used to chat-based AI assistants that can help us. We’ve all grown accustomed to chatbots that “remember” us and the conversation we had before.

From virtual assistants that recall our preferences to support bots that track our past issues, chat memory feels like a natural part of interacting with digital agents. It’s easy to assume that modern AI models like ChatGPT or other LLM-powered bots possess similar built-in memory.

Ensuring Safe and Reliable AI Interactions with LLM Guardrails

Tue, 17 Jun 2025 07:11:24 +0000

Integrating Large Language Models (LLMs) into our applications is becoming increasingly popular. These models are extremely useful for creating content, searching documentation, and solving more complex problems. However, with great power comes great responsibility.

We know that LLMs can and will make mistakes, and while enriching your prompts with the proper context can help align results with your documents and information, risks still remain. Along with the rise of LLMs, new attack vectors are surfacing. Clever prompt injections can lead to misinformation and‌ escalate privacy-sensitive information.

Foojay Podcast #72: JCon Report, Part 1 - Grow your career, public speaking, 30 years of Java, greener coding,...

Mon, 02 Jun 2025 13:55:37 +0000

On May 13th and 14th, Foojay attended the JCON conference in Köln, Germany, where we did over 30 live-stream interviews. In this episode, we present to you the first set of these interviews, in which we focus on celebrating 30 years of Java, how you can grow your career, become a public speaker and writer, make your code more green, a bit of AI (of course…), and how the connections between open-source contributors can be visualized.

What is RAG, and How to Secure It

Fri, 16 May 2025 11:48:16 +0000

Integrating large language models (LLMs) into your application is more accessible than ever. With a few API calls to OpenAI, Anthropic, or Cohere, you can instantly add ++AI capabilities++ to your stack. Using frameworks and libraries that abstract this away for you makes it even easier to create your own LLM-powered assistant. However, if you’ve shipped any real-world LLM features, you’ve hit the wall where these powerful models confidently make up facts, reference outdated information, or deliver answers that don’t take your context into account.

Path Traversal Vulnerability in Deep Java Library (DJL)

Tue, 11 Mar 2025 12:21:50 +0000

Deep Java Library (++DJL++ ) is an open source deep learning framework that brings AI capabilities to Java developers without requiring a shift to Python.

It provides an intuitive, high-level API for building, training, and deploying machine learning models, supporting deep learning engines like TensorFlow, PyTorch, and MXNet.

While not as widely adopted as Python-based frameworks, DJL is gaining traction in Java-based AI applications, especially in enterprise software, cloud environments, and financial services.

Creating SBOMs with the Snyk CLI

Fri, 07 Mar 2025 12:25:36 +0000

The software bill of materials (SBOM) is quickly becoming an essential aspect of open source security and compliance. In this post, we’ll delve into what SBOMs are, why they’re necessary, and their role in open source security.

What are SBOMs?

A software Bill of Materials (SBOM) is a comprehensive inventory of all components used in a software product. They include all the necessary details about each component, such as their names, versions, and licensing information. SBOMs can be seen as the ingredients list for software, providing complete transparency into what makes up a software product.

Foojay Podcast #58: How Java Developers Can Secure Their Code

Mon, 30 Sep 2024 07:43:46 +0000

Three years after Log4Shell caused a significant security issue, we still struggle with insecure dependencies and injection problems.

In this podcast, we’ll discuss how developers can secure their code.

I talked with three authors who posted a security and code quality post on Foojay.io.

Video

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

The Persistent Threat: Why Major Vulnerabilities Like Log4Shell and Spring4Shell Remain Significant

Tue, 17 Sep 2024 16:17:07 +0000

This article was originally published at Snyk.io

As developers, we’re constantly juggling features, fixes, and deadlines. Yet, a lurking issue has been surprisingly overlooked: the continued use of vulnerable Log4j and Spring Framework versions in many projects.

Despite the high-profile exposure of Log4Shell and Spring4Shell vulnerabilities, a shocking number of applications are still running on these ticking time bombs. This isn’t just a minor oversight — it’s a major risk. We’re builders at heart, but part of building is ensuring our structures are safe.

Four Easy Ways to Analyze your Java and Kotlin Code for Security Problems

Fri, 30 Aug 2024 09:07:43 +0000

Originally published at Snyk.io .

Nowadays, the security of your applications is just as important as the functionality they provide. Therefore, analyzing your code for security vulnerabilities is a vital part of maintaining the integrity of your applications and protecting your users’ data. As developers, we are at the front lines of this battle. It’s our responsibility to ensure that the code we write is not just functional and efficient but also secure.

Securing Symmetric Encryption Algorithms in Java

Fri, 29 Dec 2023 05:53:50 +0000

In our connected world, securing digital data has become an utmost priority. With the wide spread of Java applications in various sectors, from banking to healthcare, we must emphasize the importance of encryption. Encryption is converting readable data or plaintext into unreadable data or ciphertext, ensuring that even if encrypted data is intercepted, it remains inaccessible to unauthorized individuals.

The first choice you must make as a developer is whether you need encryption. Although this sounds like a strange question, the key principle of encryption is that the ciphertext can be reverted into the original text.

Handling security vulnerabilities in Spring Boot

Fri, 22 Dec 2023 14:59:10 +0000

In the world of software development, managing dependencies is a core part of creating strong and secure applications. Spring Boot, a favorite among Java developers, makes building applications easier, but there’s more to it than meets the eye. Keeping your dependencies in check is crucial to ensure that your Spring Boot projects run smoothly and remain resilient in the face of ever-evolving threats.

One critical aspect of Spring Boot dependency management is security. Software vulnerabilities are discovered frequently, and by keeping your project’s dependencies up to date, you’re essentially putting on your digital security armor. Outdated dependencies can be like unlocked doors, inviting trouble from potential threats, and that’s something we’d like to avoid.

Using JLink to create smaller Docker images for Spring Boot apps

Thu, 21 Sep 2023 11:33:05 +0000

Containers bring new flexibility and agility to software development and deployment. However, they also introduce a new attack surface that malicious actors can exploit. A compromised container can give an attacker access to other containers and even the host system. Smaller images that contain fewer artifacts are already a great help in achieving a smaller attack surface.

In this article, we’ll present an in-depth exploration of utilizing JLink to optimize Docker image sizes, enhancing application security and performance. We’ll showcase how to use JLink and integrate it with Docker to efficiently deploy your Spring Boot or general Java applications.

SnakeYaml 2.0: Solving the unsafe deserialization vulnerability

Thu, 20 Jul 2023 07:17:16 +0000

In December of last year, we reported ++CVE-2022-1471++ to you. This unsafe deserialization problem could easily lead to arbitrary code execution under the right circumstances.

In the deep-dive blog post “++Unsafe deserialization vulnerability in SnakeYaml (CVE-2022-1471)++ ”, I explained the problems in this library and how it could be executed. The gist of the problem was that by default SnakeYaml parsed the incoming yaml to the generic object type.

Preventing Cross-Site Scripting (XSS) in Java with Snyk Code

Fri, 09 Jun 2023 15:23:39 +0000

Java is a powerful backend programming language that can also be used to write HTML pages for web applications. However, developers must know the potential security risks associated with Cross-Site Scripting (XSS) attacks when creating these pages.

With the rise of modern templating frameworks, preventing security attacks through proper input validation and encoding techniques has become easier.

However, when developers choose to create their own HTML pages without using a templating framework, there is an increased risk of introducing vulnerabilities.

Mitigating Path Traversal Vulnerabilities in Java

Fri, 24 Mar 2023 07:57:06 +0000

Path traversal is a type of security vulnerability that can occur when a web application or service allows an attacker to access server files or directories that are outside the intended directory structure.

This can lead to the unauthorized reading or modification of sensitive data.

In the context of file uploads, a path traversal vulnerability can occur when an application fails to properly validate the file path specified by the user, which can allow the attacker to upload a malicious file with a filename that gives them access to restricted files on the server.

How to create SBOMs in Java with Maven and Gradle

Fri, 17 Mar 2023 09:08:28 +0000

When building applications in Java, we highly depend on external libraries and frameworks. And each Java package that is imported likely also depends on more libraries. This means that the amount of Java packages included in your application is often not really transparent.

As a developer, these nested (transitive) dependencies create the problem that you probably do not know all the libraries you are actually using.

Recently, we discussed why and how we should maintain our dependencies carefully. In the article Best practices for managing Java dependencies , I discussed the options and tools available for setting up a dependency management strategy.

Unsafe Deserialization Vulnerability in SnakeYaml

Thu, 12 Jan 2023 13:19:29 +0000

SnakeYaml is a well-known YAML 1.1 parser and emitter for Java.

Recently, a vulnerability — CVE-2022-1471 — was reported for this package. This vulnerability can lead to arbitrary code execution.

The org.yaml:snakeyaml package is widely used in the Java ecosystem, in part because it is packaged by default with Spring Boot in the spring-boot-starter.

In this article, we look into the security vulnerability affecting this Java library, discuss the potential hazardous impact it may have on your applications, and weigh the actual risks.

Foojay Podcast #7: Security in Java -- what do we need to know?

Mon, 21 Nov 2022 10:22:14 +0000

For this Foojay Podcast**,** we invited security experts to dive into the fascinating world of secure coding and detecting vulnerabilities in your Java applications.

How can you make and keep your systems safe?

That’s what we want to find out…

Podcast Apps

You can listen and subscribe to the Foojay Podcast on:

CVE-2022-42889: Apache Commons Text (Text4Shell) Vulnerability

Thu, 03 Nov 2022 14:56:24 +0000

First things first, let’s be clear that this is NOT a new Log4Shell or Spring4Shell vulnerability.

Although it is a remote code execution issue, the impact is neither as severe nor as easily exploitable as the issue in Log4j from December 2021.

Similar to the Log4j issue, the essence of the problem is that you can perform a lookup that can then be misused.

However, the Log4shell vulnerability was very easy to exploit — which is not necessarily the case this time.

How to Use Java DTOs to Stay Secure

Fri, 21 Oct 2022 07:29:57 +0000

~~This article was orignally posted on Snyk.io and is reused with permission.~~

Data Transfer Objects (DTOs) in Java are objects that transport data between subsystems.

It is an enterprise design pattern to aggregate data.

The main purpose is to reduce the number of system calls needed between the subsystems, reducing the amount of overhead created.

In this article, I will explain how DTOs are used in modern Java applications, ways your application can benefit, and how Java DTOs can help you be more secure by preventing accidental data leaks.

Best Practices for Managing Java Dependencies

Thu, 15 Sep 2022 08:21:10 +0000

Creating Java applications is great, and many resources are available.

To speed up development, many folks use frameworks and libraries that do some of the heavy lifting.

When looking at modern Java applications, almost all of them contain dependencies from libraries developed by someone else.

Dependencies take up about 80 to 90 percent of the binary — so, we should take good care of them when creating a Java project.

Controlling your Server with a Reverse Shell Attack

Thu, 08 Sep 2022 13:00:22 +0000

Creating and running an application in your favorite language is usually pretty simple. After you create your application, deploying it and showing it to the world is also quite straightforward.

The last thing you need is someone to take over your system and fully control your brand new application.

In this article, I’ll explain how this can happen with a remote shell attack.

Note: The code examples in this article are for educational purposes only. I mainly try to explain what a remote shell attack is and how it can occur in your applications. Using this or any other example to hack someone is not advised. In most countries, hacking without the consent of the target is illegal, even if you have the best intentions.

Exploring the Apache Commons Configuration RCE Vulnerability

Thu, 18 Aug 2022 10:10:37 +0000

This article was originally posted on Snyk.io and is co-written by Kyle Suero and Brian Vermeer

Before we dive into the details of this vulnerability, we want to make it clear that there’s no need for panic.

Many systems permit the use of various types of code in configuration files, and there are legitimate use cases to include string and variable interpolation in the configuration of applications and systems.

This is not Log4Shell all over again.

Secure CI/CD Pipelines with GitHub Actions for Your Java Apps

Thu, 11 Aug 2022 06:28:38 +0000

This article was originally post atSnyk.io and is used with permission

GitHub Actions has made it easier than ever to build a secure continuous integration and continuous delivery (CI/CD) pipeline for your GitHub projects.

By integrating your CI/CD pipeline and GitHub repository, GitHub Actions allows you to automate your build, test, and deployment pipeline.

You can create workflows that build and test every pull request to your repository or deploy merged pull requests to production.

Deserialization exploits in Java: why should I Care?

Thu, 14 Jul 2022 07:39:03 +0000

Hackers refer to deserialization in Java as “the gift that keeps on giving”. But what is actually the problem? In most cases, it is not even your own code that creates this security vulnerability. This problem is also not restricted to Java’s custom serialization framework. When deserializing JSON, XML, or YAML, similar issues can occur as well.

I recently gave a talk about this during Devoxx UK , the largest and most prestigious Java community conference in the United Kingdom. In this talk, I explain how deserialization vulnerabilities work natively in Java and how attack chains are created. This was loosely based on my blog post: “Serialization and deserialization in Java: explaining the Java deserialize vulnerability” .

How to do password hashing in Java applications the right way

Thu, 12 May 2022 15:04:55 +0000

There are multiple ways to store sensitive passwords. And while having choices can be great, in the context of password storage, picking wrong can be a security nightmare. With that in mind, let’s hash out some of your options 🥁🥁.In this article we’ll discuss how you should hash passwords in your Java applications. While you can apply these principles to any ecosystem, we’ll specifically showcase the best way to handle password hashing in Java.

Spring4Shell: The zero-day RCE in the Spring Framework explained

Fri, 08 Apr 2022 04:17:45 +0000

On March 30, 2022, a critical remote code execution (RCE) vulnerability was found in the Spring Framework. More specifically, it is part of the spring-beans package, a transitive dependency in both spring-webmvc and spring-webflux. This vulnerability is another example of why securing the software supply chain is important to open source.

Security resources like Lunasec , Rapid7 and Praetorian confirmed that the vulnerability is real, and in the meantime, Spring has already released a new version that mitigates this problem, so we recommend updating . While Spring4Shell does not appear to have the same impact as the recent Log4Shell vulnerability, it should still be evaluated and prioritized by every organization using the Spring Framework. In this post, we’ll explore how the RCE works.

Security Warning: Your Java Attack Surface Just Got Bigger

Thu, 17 Mar 2022 16:35:38 +0000

Building cloud-native Java applications is undoubtedly awesome.

However, it comes with undeniable new risks. Next to your own code, you are relying on so many other things.

Blindly depending on open-source libraries and Docker images can form a massive risk for your application. The wrong package can introduce severe vulnerabilities into your application, exposing your application and your user’s data.

In the talk below we’ll show common threats, vulnerabilities, and misconfiguration including the recently disclosed issues in Log4j. Most importantly, you’ll learn how to protect your application with actionable remediation and best practices.

Java Logging: What To Log & What Not To Log?

Sat, 18 Dec 2021 11:29:33 +0000

Logs are a handy tool to spot mistakes and debug code. For engineers and, specifically, in a DevOps environment, the logs are a very valuable tool.

In addition to the functional aspect of logging, logs are also critical from a Java security perspective. When a security breach occurs, your log files are the first place to look for clues about what happened. But with a large number of different frameworks available for logging in Java applications, how do you pick the right one? More importantly, how to do Java logging right?

Log4Shell: Critical Log4j RCE Vulnerabilty -- Update to Version 2.15.0

Mon, 13 Dec 2021 07:16:56 +0000

On Dec.10, 2021, a new, critical Log4j vulnerability was disclosed: Log4Shell .

This vulnerability within the popular Java logging framework was published as CVE-2021-44228 and categorized as Critical with a CVSS score of 10, which is the highest score possible. The vulnerability was discovered by Chen Zhaojun from Alibaba’s Cloud Security team.

All current versions of log4j2 up to and including 2.14.1 are vulnerable. You can remediate this vulnerability by updating to version 2.15.0 or later .

New Java 17 Features for Improved Security and Serialization

Thu, 02 Dec 2021 08:06:36 +0000

In December 2020, I wrote the articleSerialization and deserialization in Java: explaining the Java deserialize vulnerability about the problems Java has with its custom serialization implementation. The serialization framework is so deeply embedded inside Java that knowing how dangerous some implementation can be is important. Insecure deserialization can lead to arbitrary code executions if a gadget chain is created from your classpath classes.

Recently, Java 17 — the new LTS version — was released. But how do the new features impact this problem, and can we prevent deserialization vulnerabilities better using these features?

How Social Trends Help Me Fix Essential Vulnerabilities

Thu, 04 Nov 2021 14:14:55 +0000

Recently, Snyk added social trends to its vulnerability data . This new indicator shows you what vulnerabilities are trending so you can better prioritize remediation. Our research team found a strong correlation between socially trending vulnerabilities and the existence of exploits that can actually harm your application.

Following the social trends of security vulnerabilities makes practical sense. When a specific vulnerability is gaining a lot of interest in social — Twitter, for instance — it means a lot of people are aware of the problem. Statistically, this also means more people that want to do you harm. Therefore, it can be important to put some extra focus on the vulnerabilities in your system that are socially trending.

Discussion: The State of Java 2021

Mon, 25 Oct 2021 14:05:56 +0000

There is a lot going in the Java world lately. A lot of this is already captured is the Snyk JVM Ecosystem Report 2021 based on a joint survey by Azul and Snyk . In addition, Java 17 — the new LTS version — was released in September and Oracle uncovered their plans to shorten the LTS release cycle to every 2 years.

In a recent livestream, I had a discussion with some great folks in the Java world about the highlights of the Snyk Java Ecosystem report and the current developments in the Java world.

Why You Should Upgrade to Maven Version 3.8.1 Today or Very Soon

Wed, 11 Aug 2021 08:06:09 +0000

If you are working in the Java ecosystem and building your applications with an older Maven version, this message is for you.

Check your Maven version by typing mvn -version! If you are still running on an old Maven version like 3.6.3 or below you definitely need to upgrade to version 3.8.1 because of security reasons. Be aware that to run Maven 3.8.1, Java 7+ is required.

Luckily we found out in the JVM Ecosystem report 2021 that not many people work with Java 6 or below. We do see that a lot of people use Maven so not upgrading can end up in serious issues for a large part of the ecosystem.

Getting Started with Snyk for Secure Java Development

Thu, 29 Jul 2021 06:39:02 +0000

If you’re a Java developer who wants to develop your applications more securely, you’ve come to the right place. Snyk can help you with that mission.

This article will explain how to begin with Snyk for secure Java development so you can be more secure from the get-go.

If you’re new to Snyk, it’s important to know that we offer a variety of developer-focused products and tools. Some of these tools, like our CLI and some IDE integration, support multiple products. However, we can distinguish four different products within Snyk:

New JVM Ecosystem Report 2021 Has Arrived!

Fri, 18 Jun 2021 08:14:41 +0000

Snyk has just released the annual JVM ecosystem report! This report presents the results of the largest annual survey on the state of the JVM ecosystem.

This year’s survey is a cooperation between Snyk and Azul and was slightly different from the previous surveys. We aimed for the survey to be more concise and focus only on the most important aspects of JVM developers today. Additionally, this year every participant was allowed to choose multiple options. We believe that the way the 2021 survey was designed, we have a better and more comprehensive view of the current JVM ecosystem. In this report, we also looked at different open data sources like GitHub and Google Trends to see how that data compares to the survey results.

Learn All About Java Encryption and Hashing

Thu, 10 Jun 2021 08:04:22 +0000

If you need to store sensitive data in your system, you have to be sure that you have proper encryption in place. First of all, you need to decide what kind of encryption you need —for instance, symmetric or asymmetric. Also, you need to choose how secure it needs to be. Stronger encryption takes more time and consumes more CPU. The most important part is that you don’t need to implement the encryption algorithms yourself. Encryption is hard and a trusted library solves encryption for you.

Sanitize All Input! Sanitize All Input! Sanitize All Input!

Thu, 13 May 2021 07:23:33 +0000

Cross-site scripting (XSS) is a well-known issue and mostly utilized in JavaScript applications. However, Java is not immune to this. XSS is nothing more than an injection of JavaScript code that’s executed remotely. Rule #0 for preventing XSS, according to OWASP, is “Never insert untrusted data except in allowed locations.” The basic solution to this Java security risk is to prevent untrusted data, as much as possible, and sanitize everything else before using the data.

Preventing YAML Parsing Vulnerabilities in Java

Thu, 06 May 2021 16:09:24 +0000

YAML is a human-readable language to serialize data that’s commonly used for config files. The word YAML is an acronym for “YAML ain’t a markup language” and was first released in 2001. You can compare YAML to JSON or XML as all of them are text-based structured formats.

YAML files are often used to configure applications, application servers, or clusters. It is a very common format in Spring Boot applications and, of course, to configure Kubernetes. However, similarly to JSON and XML, you can use YAML to serialize and deserialize data.

Fix Java Security Issues While Coding in IntelliJ IDEA

Thu, 29 Apr 2021 17:10:33 +0000

Nowadays, developers are responsible for more than just creating the application. Besides working on features, developers have to focus on their applications’ maintainability, scalability, reliability, and security. Many developers are unsure of where to start with security. In addition, most companies still work with a dedicated security team instead of having security expertise inside the team.

A lot of developers practically live in their integrated development environment (IDE). A good IDE is like a swiss army knife: it is your go-to tool to do almost everything. Having everything I need to build, run, test, debug, andsecure my application, makes a good IDE invaluable for many developers.

8 Best Practices to Prevent SQL Injection Attacks

Thu, 15 Apr 2021 08:33:39 +0000

SQL injection is one of the most dangerous vulnerabilities for online applications. It occurs when a user adds untrusted data to a database query. For instance, when filling in a web form. If SQL injection is possible, smart attackers can create user input to steal valuable data, bypass authentication, or corrupt the records in your database.

There are different types of SQL injection attacks, but in general, they all have a similar cause. The untrusted data that the user enters is concatenated with the query string. Therefore the user’s input can alter the query’s original intent.

Participate in the Java Ecosystem Survey 2021

Thu, 01 Apr 2021 16:03:13 +0000

Just like in 2020, Snyk is creating a comprehensive Java 2021 report that reflects the state of the JVM ecosystem.

Note: Friday, 2 April, the survey will come to an end, after running since the middle of February, spread the word! 🙂
Go to the Java 2021 survey

Here’s the summary of the JVM Ecosystem 2020 report:

As always, we couldn’t have done this without you! So, once again, we ask for your help with the 2021 edition of the JVM Ecosystem Report.
Go to the Java 2021 survey

Secure Code Review Best Practices (Part 2)

Thu, 18 Mar 2021 15:14:31 +0000

Code reviews are hard to do well. Particularly when you’re not entirely sure about the errors you should be looking for!

In part 1 of this series , we focused on four best practices, such as sanitization , storing secrets, and scanning your application are explained so take a quick look if you missed the first part.

Let’s move on to the second and final part of this topic, tips 5 through 8!

Secure Code Review Best Practices (Part 1)

Thu, 11 Mar 2021 16:58:46 +0000

Code reviews are hard to do well. Particularly when you’re not entirely sure about the errors you should be looking for!

Be sure when you’re reviewing code to understand that all code isn’t written equal! Think also about what lies behind the code that you’re reviewing and thus the data and assets you are trying to protect. This working knowledge is something that isn’t easy to add into a checklist.

Explaining Java Deserialization Vulnerabilities (Part 2)

Thu, 28 Jan 2021 08:23:00 +0000

Java serialization is a mechanism to transform an object into a byte stream. Java deserialization is exactly the other way around and allows us to recreate an object from a byte stream. Java serialization—and more specifically deserialization in Java—is also known as “the gift that keeps on giving”. This relates to the many security issues and other problems it has produced over the years.

Explaining Java Deserialization Vulnerabilities (Part 1)

Earlier, in part 1, the basics of Java serialization and deserialization were explained and how to tamper with data in serialized objects. In this part, we continue with even more harmful attacks and show you how you can prevent this in your own code.

Explaining Java Deserialization Vulnerabilities (Part 1)

Thu, 21 Jan 2021 10:12:19 +0000

Java serialization is a mechanism to transform an object into a byte stream. Java deserialization is exactly the other way around and allows us to recreate an object from a byte stream.

Java serialization—and more specifically deserialization in Java—is also known as “the gift that keeps on giving”. This relates to the many security issues and other problems it has produced over the years.

Serialization and Deserialization in Java?

In Java, we create objects. These objects live in memory and are removed by the garbage collector once they are not used anymore. If we want to transfer an object, for instance, store it on a disk or send it over a network, we need to transform it into a byte stream. To do this, the class of that object needs to implement the interface Serializable. Serialization is converting the state of an object into a byte stream. This byte stream does not contain the actual code.

Hacking Java XML Input via External Entity Injection

Thu, 14 Jan 2021 08:37:10 +0000

Java natively supplies many different options to parse XML. However, all available parsers in Java have XML eXternal Entity (XXE) enabled by default. This makes Java XML libraries particularly vulnerable to XXE injection.

We already briefly went into XXE injection problem in an earlier blog post on foojay.io. However, let’s go a little deeper. In the video below, I explain and demonstrate how an XXE injection attack works by extracting system data that should not be exposed. I also show you how you can solve this in your Java code in multiple ways.

5 Tips to Create Secure Docker Images for Java Applications

Fri, 25 Dec 2020 10:41:54 +0000

Docker is the most widely used way to containerize your application. With Docker Hub, it is easy to create and pull pre-created images. This is very convenient as you can use these images from Docker Hub to quickly build an image for your Java application.

However, the naive way of creating custom Docker images for your Java applications comes with many security concerns. So, how do we make security an essential part of Docker images for Java?

Minimizing Security Risks in Application Development

Tue, 08 Dec 2020 11:02:28 +0000

United by their passion for open source, Payara and IBM recently teamed up for a panel discussion on security in Java application development.

Security is something that is considered extremely important, however, it is not always something that is a priority for many development teams. The main question is—how to minimize security risks while developing Java applications.

In this panel discussion, our experts addressed a variety of topics related to secure application development. Most of the topics were introduced by questions from the audience.

Use Query Parameterization to Prevent Injection

Mon, 23 Nov 2020 08:14:52 +0000

In the 2017 version of the OWASP Top 10 vulnerabilities, injection appeared at the top of the list as the number one vulnerability that year.

When looking at a typical SQL injection in Java, the parameters of a sequel query are naively concatenated to the static part of the query. The following is an unsafe execution of SQL in Java, which can be used by an attacker to gain more information than otherwise intended:

Avoid Java Serialization: The Gift That Keeps On Giving

Wed, 11 Nov 2020 08:48:37 +0000

Serialization in Java allows us to transform an object to a byte stream. This byte stream is either saved to disk or transported to another system. The other way around, a byte stream can be deserialized and allows us to recreate the original object.

The biggest problem is with the deserializing part. Typically it looks something like this:

ObjectInputStream in = new ObjectInputStream( inputStream );
return (Data)in.readObject();

There’s no way to know what you’re deserializing before you decoded it. Possibly, an attacker serialized a malicious object and sent it to your application. Once you call readObject(), the malicious objects have already been instantiated. You might believe that these kinds of attacks are impossible because you need to have a vulnerable class on you classpath. However, if you consider the amount of classes on your classpath—that includes your own code, Java libraries, third-party libraries and frameworks—it is very likely that there is a vulnerable class available.

How to Configure Your Java XML Parsers to Prevent XXE Attacks

Fri, 06 Nov 2020 11:27:18 +0000

With XML eXternal Entity (XXE) enabled, it is possible to create a malicious XML, as shown below, and read the content of an arbitrary file on the machine. It’s not a surprise that XXE attacks are part of the OWASP Top 10 vulnerabilities. Java XML libraries are particularly vulnerable to XXE injection because most XML parsers have external entities by default enabled.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!DOCTYPE bar [
 <!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<song>
 <artist>&xxe;</artist>
 <title>Bohemian Rhapsody</title>
 <album>A Night at the Opera</album>
</song>

A naive implementation of the DefaultHandler and the Java SAX parser, like that shown below, parses this XML file and reveals the content of the passwd file. The Java SAX parser case is used as the main example here but other parsers, like DocumentBuilder and DOM4J, have similar default behaviour.

Fixing Vulnerabilities in Maven-Based Projects

Tue, 20 Oct 2020 06:40:22 +0000

Maven is still the most used build system in the Java ecosystem. According to the JVM report 2020 , Maven is the number one build tool in the ecosystem with two-thirds of the share.

Therefore, it is important to know how Maven works. For instance, if you find vulnerabilities in your Maven project using Snyk, how can you fix them?

In this article, I will explain how you can fix vulnerabilities in third-party libraries when using Maven, even when it is not obvious.