CVE-2021-41588: 
Gradle vulnerability analysis and mitigation

In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The vulnerability (CVE-2021-41588) was discovered in May 2021 and affects Gradle Enterprise versions from 2017.2 through 2021.1.2. The attacker must have the encryption and signing keys to exploit this vulnerability (Gradle Advisory).

The vulnerability stems from how Gradle Enterprise handles application session data stored as client-side cookies. The session data is encrypted and signed with randomly generated, installation-specific keys before being stored. When processing a request, this data is deserialized into Java objects. This is classified as an 'insecure deserialization' or 'gadget vulnerability'. The vulnerability has a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

If successfully exploited, an attacker who has obtained the encryption and signing keys could craft HTTP requests that deserialize unsafe objects, potentially leading to remote code execution on the affected system (Gradle Advisory).

The vulnerability was patched in Gradle Enterprise version 2021.1.3, which implemented additional measures to prevent the deserialization of arbitrary unsafe objects. The recommended mitigation is to upgrade to version 2021.1.3 or later (Gradle Advisory).