CVE-2022-44262: 
Java vulnerability analysis and mitigation

ff4j version 1.8.1 contains a Remote Code Execution (RCE) vulnerability that was disclosed on December 1, 2022. The vulnerability affects the property handling functionality within the ff4j-core component (MITRE CVE, GitHub Issue).

The vulnerability exists in the PropertyFactory.java file within the ff4j-core component, specifically in the createProperty function. The issue allows attackers to call any constructors in the project or JVM through property manipulation. While the operation results in an error after the constructor call, it still enables potential malicious code execution (GitHub Issue).

The vulnerability allows remote attackers to execute arbitrary code on affected systems. This could potentially lead to complete system compromise, as the ability to execute arbitrary constructors provides significant control over the application's behavior (MITRE CVE).

A proof of concept exploit has been publicly disclosed. The vulnerability can be triggered by sending a specially crafted PUT request to the /api/ff4j/propertyStore/properties endpoint. The exploit demonstrates the ability to cause SSRF (Server-Side Request Forgery) by manipulating the property type and value (GitHub Issue).