CVE-2021-29485: 
Java vulnerability analysis and mitigation

Ratpack, a toolkit for creating web applications, was found to contain a critical Remote Code Execution (RCE) vulnerability (CVE-2021-29485) in versions prior to 1.9.0. The vulnerability exists in the Ratpack session store mechanism, where malicious attackers can achieve RCE through a maliciously crafted Java deserialization gadget chain. The vulnerability was disclosed on June 29, 2021, and affects all versions of Ratpack before version 1.9.0. Applications that do not use Ratpack's session mechanism are not vulnerable to this issue (GitHub Advisory).

The vulnerability stems from insecure deserialization in Ratpack's session storage mechanism. When using server-side storage, attackers who can write to the session data store can craft payloads that deserialize unsafe objects. For client-side storage, attackers would need to obtain the secrets used to encrypt and/or sign the session data stored in user cookies. While Ratpack's session mechanism requires exact type matching for deserialization, the process of deserializing a known/trusted type may attempt to deserialize unsafe types. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH by NVD and 9.9 CRITICAL by GitHub (NVD).

Successful exploitation of this vulnerability could allow attackers to execute arbitrary code remotely on the affected system. The vulnerability is particularly severe as it could lead to complete system compromise through remote code execution. The impact varies depending on whether server-side or client-side session storage is used, with different attack vectors requiring different levels of access to exploit the vulnerability (GitHub Advisory).

The vulnerability can be exploited in two scenarios: 1) In server-side storage implementations, attackers need the ability to write to the session data store, and 2) In client-side storage implementations, attackers need to obtain the secrets used for encrypting/signing session data cookies. The exact types of payloads required for exploitation depend on the specific serialization mechanism used (GitHub Advisory).

The vulnerability has been patched in Ratpack version 1.9.0, which introduces a strict allow-list mechanism for serialization/deserialization. For users of earlier versions, two workaround options are available: 1) Reduce the likelihood of attackers being able to write to the session data store, or 2) Manually backport the allow-list mechanism by providing an alternative implementation of SessionSerializer. Upon upgrading to version 1.9.0, users must explicitly declare all types currently being serialized as safe using the new SessionModule.allowTypes() method (GitHub Advisory).