Description

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-08T08:17:11.563Z",
  "pubdate": "2026-09-08T08:17:11.563Z",
  "executiveSummary": "The Cosminexus Component Container is susceptible to a deserialization of untrusted data vulnerability. This vulnerability arises when the application improperly processes serialized objects from untrusted sources without adequate validation or filtering.\nSuccessful exploitation of this flaw allows an unauthenticated or authenticated remote attacker to perform arbitrary code execution (ACE) within the context of the application's process. The vulnerability resides in how the component container handles incoming serialized data streams.\nImpacted systems include multiple versions of the Cosminexus Component Container ranging from 09-00 to 11-70-02. Given the nature of Java deserialization vulnerabilities, the risk is classified as critical, as it can lead to full system compromise, data theft, or denial of service.\nAttackers can leverage this vulnerability by crafting malicious serialized objects and delivering them to the vulnerable component. No specific authentication is required if the entry point is exposed to the network, making this an attractive vector for external exploitation. Mitigation requires immediate attention to vendor-supplied patches to restrict or sanitize the deserialization process.",
  "technicalDetails": "The vulnerability is a classic Java Deserialization flaw within the Cosminexus Component Container. It occurs because the application fails to perform sufficient validation on serialized objects received from untrusted endpoints before invoking the readObject() method or equivalent deserialization routines.\nIn Java, deserialization is the process of converting a stream of bytes back into a live object. If the application environment contains 'gadget chains'—classes present in the classpath that perform dangerous actions (like executing OS commands or writing files) during the deserialization or object finalization process—an attacker can instantiate these classes by injecting a malicious binary payload into the data stream.\nThe attack flow proceeds as follows: First, the attacker identifies an input vector where serialized data is accepted, such as an RMI interface, JMX port, or an HTTP endpoint handling serialized Java objects. Second, the attacker utilizes tools like ysoserial to generate a payload containing a serialized gadget chain tailored for the target's classpath. Third, the attacker sends this payload to the Cosminexus Component Container. Upon receipt, the JVM automatically triggers the execution of the gadget chain while reconstructing the object, leading to the execution of arbitrary commands with the privileges of the container process.\nThe scope of affected versions is broad, covering major releases including: 11-70-01 to 11-70-02, 11-60 to 11-60-02, 11-50 to 11-50-03, 11-40 to 11-40-03, 11-30 to 11-30-08, 11-20 to 11-20-09, 11-10 to 11-10-11, 11-00 to 11-00-12, 09-87 to 09-87-09, 09-80 to 09-80-04, 09-70 to 09-70-27, 09-50 to 09-50-22, and 09-00 to 09-00-18.\nSince the vulnerability exists within the object reconstruction process, standard perimeter security measures like WAFs may fail to detect the complex binary structure of the malicious serialized payload unless deep packet inspection for Java serialization signatures is implemented. Post-exploitation, an attacker gains the ability to execute shell commands, install persistent backdoors, pivot within the internal network, or exfiltrate sensitive configuration files and user data from the application container."
}