Description

A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/Redis.scala of the component Kryo Handler. Such manipulation leads to deserialization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-09-15T15:17:33.120Z",
  "pubdate": "2026-09-15T15:17:33.120Z",
  "executiveSummary": "OpenBankProject OBP-API versions up to 1.10.1 contain a critical security vulnerability involving insecure deserialization within the Kryo Handler component. The flaw resides in the KryoInjection.invert function located in the obp-api/src/main/scala/code/api/cache/Redis.scala file.\nThis vulnerability allows remote attackers to execute arbitrary code or trigger denial-of-service conditions by providing maliciously crafted serialized objects. Because the application deserializes untrusted data through the Kryo library without adequate validation or sanitization, the integrity and confidentiality of the entire OBP-API instance are at risk.\nThe attack vector is remote, meaning no local access is required to initiate the exploitation. While the attack complexity is classified as high and exploitability as difficult, the public disclosure of the vulnerability increases the risk of targeted exploitation. Developers and system administrators must prioritize addressing this flaw, as the project maintainers have not yet provided an official resolution to the reported issue.",
  "technicalDetails": "The vulnerability originates from the improper handling of serialized objects via the Kryo library, specifically within the KryoInjection.invert function in obp-api/src/main/scala/code/api/cache/Redis.scala. Kryo is a binary serialization framework for Java that, when misconfigured, is inherently susceptible to deserialization attacks if it operates on input streams from untrusted sources.\nThe attack flow begins with the delivery of a malicious payload to the endpoint that utilizes the vulnerable Redis-based cache handler. In a typical deserialization attack, the attacker crafts a sophisticated byte stream—often using gadget chains—that, when reconstructed by the Kryo framework, forces the JVM to execute arbitrary code or access sensitive memory regions. Since KryoInjection.invert is used for transforming cache data back into object form, it processes the data directly from the Redis storage mechanism.\nIf an attacker can manipulate the data stored within the Redis cache or intercept the communication channel to inject arbitrary serialized data into the cache, the application will automatically perform deserialization upon the next retrieval attempt. The lack of an allow-list or security constraints during the deserialization phase allows the instantiation of dangerous classes present in the application's classpath.\nThe exploitation process follows these steps: 1) Identification of the serialization format used by the Redis cache; 2) Creation of a malicious serialized object payload designed to trigger remote code execution; 3) Injection of this payload into the target Redis instance or the application’s cache storage path; 4) Triggering the application functionality that invokes KryoInjection.invert to process the tainted cache entry; 5) Execution of the payload upon deserialization.\nThe impact of this vulnerability is severe, potentially allowing for full system compromise, data exfiltration from the cache, or service disruption. Given the remote accessibility and the inherent dangers of insecure deserialization, the system remains vulnerable until the underlying code is patched to prevent the instantiation of arbitrary classes during the inversion process."
}