Description

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-07T12:17:21.840Z",
  "pubdate": "2026-09-07T12:17:21.840Z",
  "executiveSummary": "This vulnerability involves insecure deserialization within EAP's Artemis messaging component. The system utilizes ObjectInputStreamWithClassLoader to handle ObjectMessage.getObject() calls, incorporating a filtering mechanism via checkSecurity() and isTrustedType().\nThe flaw arises because both the allow-list and block-list are empty by default. In this configuration, the isTrustedType() method incorrectly defaults to returning true for all classes when the allow-list size is zero.\nThis behavior exposes the application to arbitrary object deserialization attacks. An attacker capable of injecting malicious serialized objects into the messaging stream can achieve Remote Code Execution (RCE) by leveraging gadget chains available on the classpath.\nThe risk is critical, as it bypasses intended security boundaries. Exploitation does not require prior authentication if the messaging interface is exposed to an untrusted network. Organizations must address this by explicitly defining restrictive allow-lists to prevent the instantiation of unauthorized, potentially dangerous classes.",
  "technicalDetails": "The vulnerability resides in the deserialization process managed by the Artemis messaging subsystem within EAP. Specifically, the component uses ObjectInputStreamWithClassLoader to process incoming ObjectMessage payloads. This class is designed to implement a security check via the checkSecurity() and isTrustedType() methods, intended to restrict which classes can be instantiated during the deserialization flow.\nThe root cause is a logic error in the trust verification mechanism. When the configuration is in its default state, both the block-list and the allow-list are empty. The implementation of isTrustedType() evaluates the state of the allow-list; specifically, if the allow-list size is zero, the method implicitly returns true for every requested class. Consequently, the filtering mechanism effectively becomes a 'permit-all' filter, rendering the security check non-functional against malicious object injection.\nThe attack flow begins when an attacker identifies an endpoint where an ObjectMessage can be submitted to the Artemis component. The attacker crafts a malicious serialized payload containing a gadget chain—a sequence of class instantiations and method calls—that culminates in arbitrary code execution. Because the system fails to validate these classes against a strictly defined allow-list, the ObjectInputStreamWithClassLoader successfully deserializes the malicious payload, triggering the execution of the gadget chain upon instantiation.\nThe impact is significant, as successful exploitation allows an attacker to execute arbitrary code with the permissions of the EAP process. This may lead to a full system compromise, data exfiltration, or lateral movement within the network. Since deserialization occurs during the message processing stage, the attack is particularly dangerous in environments where messaging endpoints are accessible to external or segmented network segments. There is no requirement for sophisticated bypasses of existing filters, as the current configuration explicitly permits all classes. Mitigation requires changing the default behavior to mandate a populated allow-list, ensuring that only trusted, expected classes are permitted during the deserialization process."
}