An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPO_SESSION field of a cookie. Sending this cookie may lead to remote code execution.

References

• https://nvd.nist.gov/vuln/detail/CVE-2018-18628
• pippo-java/pippo#458
• GHSA-7fm6-2qw4-g3x3
• pippo-java/pippo@a82347d
• pippo-java/pippo@c6b2655