Description

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows Object Injection. This issue affects UYAP Document Editor: before 5.4.20.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-10-12T14:17:12.423Z",
  "pubdate": "2026-10-12T14:17:12.423Z",
  "executiveSummary": "The UYAP Document Editor is susceptible to an Object Injection vulnerability resulting from the insecure deserialization of untrusted data.\nThis vulnerability exists in versions prior to 5.4.20, potentially allowing an unauthenticated or remote attacker to execute arbitrary code or manipulate application state.\nThe core of the issue lies in the application's failure to adequately validate or sanitize serialized objects before processing them during the deserialization routine.\nBy crafting a malicious serialized payload, an attacker can coerce the application into instantiating unintended objects within the classpath, which may trigger unintended code paths or facilitate remote code execution (RCE).\nGiven the nature of document processing software, this vulnerability represents a critical risk, as successful exploitation could lead to full system compromise, data exfiltration, or unauthorized administrative control over the affected environment.\nOrganizations relying on UYAP Document Editor should treat this as a high-priority security concern, necessitating an immediate transition to patched software versions to mitigate the risk of exploitation.",
  "technicalDetails": "The UYAP Document Editor, prior to version 5.4.20, contains a deserialization of untrusted data vulnerability, specifically classified as Object Injection. This vulnerability arises because the application performs deserialization operations on data structures received from external sources without implementing adequate validation or integrity checks.\nIn Java-based environments, which are common for applications of this nature, deserialization is the process of converting a stream of bytes back into a live object. When the application deserializes an object from an untrusted source, it essentially trusts the provided data structure. If the application environment contains 'gadget chains'—specific sequences of library classes already present in the classpath—an attacker can craft a malicious object stream that, when deserialized, triggers these chains.\nThe attack flow begins with the delivery of a serialized payload to the UYAP Document Editor, likely through the file formats the editor processes or the network communication protocols it employs. Once the application begins the deserialization process, the underlying library reconstructs the malicious object. The malicious payload is designed to leverage existing classes within the editor's classpath to invoke methods that perform unintended actions during the object's lifecycle, such as inside readObject(), finalize(), or through other magic methods.\nUpon successful invocation, these chains can lead to arbitrary code execution within the context of the application's process. The privilege level of the executed code corresponds to the service account running the UYAP Document Editor, which typically possesses significant access to the local file system and internal document repositories. The impact is not limited to mere information disclosure; it allows for full system compromise, including the potential for lateral movement within the UYAP network infrastructure if the workstation is connected to sensitive Ministry of Justice systems.\nBecause the vulnerability occurs at the deserialization stage, it bypasses many traditional input validation controls. Even if the data appears structurally correct to a basic parser, the malicious intent is embedded in the object hierarchy itself. Mitigation is impossible through simple input filtering alone; it requires ensuring that the deserialization process is either avoided entirely, restricted to explicitly allow-listed classes, or secured through updated library versions that do not contain vulnerable gadget entry points."
}