CVE-2020-1953: Apache Commons Configuration RCE Flaw

CVE-2020-1953 Overview

Apache Commons Configuration versions 2.2 through 2.6 contain an insecure deserialization vulnerability in its YAML parsing functionality. The library uses a third-party YAML parser (SnakeYAML) which by default allows the instantiation of arbitrary Java classes if the YAML input includes special constructor statements. Since Apache Commons Configuration did not modify these default settings, applications that load YAML files from untrusted sources are vulnerable to remote code execution attacks.

Critical Impact

Attackers can achieve full remote code execution by crafting malicious YAML files that instantiate arbitrary Java classes, potentially leading to complete system compromise with no user interaction required.

Affected Products

• Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6
• Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c
• Oracle Healthcare Foundation versions 7.1.1, 7.2.0, 7.2.1, 7.3.0

Discovery Timeline

• March 13, 2020 - CVE-2020-1953 published to NVD
• October 2020 - Oracle releases security patches via Oracle Security Alert - October 2020
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-1953

Vulnerability Analysis

This vulnerability stems from Apache Commons Configuration's use of SnakeYAML for parsing YAML configuration files. SnakeYAML, by default, supports YAML tags that enable object instantiation during deserialization. When a YAML file contains special tags like !! followed by a fully-qualified Java class name, SnakeYAML will attempt to instantiate that class and invoke its constructor. This is a well-known class of vulnerabilities known as unsafe deserialization.

The core issue is that Apache Commons Configuration versions 2.2 through 2.6 did not configure SnakeYAML with a SafeConstructor or restrict the types of objects that can be instantiated. This means any application using these versions to parse YAML from untrusted sources inherits this dangerous default behavior.

Root Cause

The root cause is the failure to override SnakeYAML's default constructor settings. SnakeYAML's default Constructor class allows arbitrary object instantiation through YAML type tags. Apache Commons Configuration should have used SafeConstructor or implemented a custom constructor that restricts deserialization to safe, known types. The oversight in not changing these library defaults created a direct path from untrusted input to arbitrary code execution.

Attack Vector

An attacker can exploit this vulnerability by supplying a maliciously crafted YAML file to an application that uses a vulnerable version of Apache Commons Configuration. The attack requires the application to parse YAML content from an untrusted source, such as user uploads, external APIs, or network-based configuration fetching. The malicious YAML file contains special constructor tags that reference dangerous Java classes capable of executing system commands or loading remote classes.

The attack flow involves the attacker embedding a payload within a YAML document using YAML's type instantiation syntax. Common exploitation chains leverage classes available on the classpath that have dangerous side effects when instantiated, such as javax.script.ScriptEngineManager for JavaScript execution or java.lang.Runtime for command execution through gadget chains.

Detection Methods for CVE-2020-1953

Indicators of Compromise

• Presence of unusual YAML files containing !! type tags followed by Java class names in application input directories
• Log entries showing instantiation of unexpected Java classes during YAML parsing operations
• Unexpected outbound network connections from Java applications that process YAML configurations
• Process spawning from Java applications, particularly shell processes or scripting engines

Detection Strategies

• Monitor application logs for SnakeYAML parsing errors that reference unexpected class instantiation attempts
• Implement file integrity monitoring on directories where YAML configuration files are stored
• Deploy runtime application security monitoring to detect unexpected object deserialization patterns
• Scan inbound YAML content for suspicious patterns including !! tags and fully-qualified Java class names

Monitoring Recommendations

• Enable verbose logging for configuration parsing operations in affected applications
• Configure endpoint detection to alert on Java processes spawning unexpected child processes
• Implement network monitoring for applications processing external YAML content to detect command-and-control communications
• Review application dependencies using software composition analysis tools to identify vulnerable Commons Configuration versions

How to Mitigate CVE-2020-1953

Immediate Actions Required

• Upgrade Apache Commons Configuration to version 2.7 or later, which addresses the unsafe deserialization issue
• Audit all applications using Apache Commons Configuration to identify those parsing YAML from untrusted sources
• Implement input validation to reject YAML files containing !! type tags before passing to the parser
• Apply Oracle's October 2020 Critical Patch Update for affected Oracle Database Server and Healthcare Foundation deployments

Patch Information

Apache has addressed this vulnerability in Apache Commons Configuration version 2.7 and later by implementing safer YAML parsing defaults. Organizations should upgrade to the latest available version of Apache Commons Configuration. For Oracle products, security patches are available through the Oracle Security Alert - October 2020.

Related projects such as Apache Tomcat, Apache ServiceComb, and Apache Camel have also issued updates to address this dependency vulnerability. Review the Apache Tomcat Announcement and Apache ServiceComb Commit Update for details.

Workarounds

• If immediate patching is not possible, configure the YAML parser to use SnakeYAML's SafeConstructor which restricts object instantiation to safe standard types
• Implement a pre-processing filter that strips or rejects YAML content containing type instantiation tags (!!)
• Restrict file upload functionality to prevent untrusted YAML files from reaching vulnerable parsing code
• Deploy web application firewalls with rules to detect and block YAML payloads containing Java class instantiation patterns

# Verify Apache Commons Configuration version in Maven projects
mvn dependency:tree | grep commons-configuration

# Check for vulnerable versions in Gradle projects
./gradlew dependencies | grep commons-configuration

# Update Maven dependency to patched version
# In pom.xml, update to version 2.7 or later:
# <dependency>
#   <groupId>org.apache.commons</groupId>
#   <artifactId>commons-configuration2</artifactId>
#   <version>2.7</version>
# </dependency>