CVE-2025-64408: 
Java vulnerability analysis and mitigation

CVE-2025-64408 is a Java deserialization vulnerability in Apache Causeway that allows authenticated remote attackers to execute arbitrary code via user-controllable URL parameters. It affects all applications using Causeway's ViewModel functionality, specifically versions 2.0.0 through 3.4.0 and 4.0.0-M1. The vulnerability was disclosed on November 19, 2025, by reporter Slain Nico, and tracked internally as CAUSEWAY-3939. The CVSS v3.1 base score is 6.3 (Medium), while GitHub's CVSS v4 assessment rates it 9.3 (Critical) (GitHub Advisory, OSS-Security).

The root cause is CWE-502 (Deserialization of Untrusted Data): Apache Causeway deserializes user-supplied data embedded in URL parameters without sufficient validation, enabling object injection (CAPEC-586). The vulnerability specifically manifests in the ViewModel functionality, where serialized Java objects passed through URL parameters are deserialized server-side without integrity checks. Affected Maven packages include causeway-commons, causeway-applib, causeway-core, and causeway-viewer-wicket, all versions prior to 3.5.0. Patches are available in commits bef00f5, e66290f, and e6bf00c in the Apache Causeway repository (GitHub Advisory, OSS-Security).

Successful exploitation allows authenticated attackers to execute arbitrary code with the privileges of the application process, resulting in high confidentiality, integrity, and availability impact on the vulnerable system per the CVSS v4 assessment. An attacker could read sensitive application data, modify or destroy data, and disrupt service availability. Depending on the deployment environment, successful RCE could also enable lateral movement within internal networks or cloud environments (GitHub Advisory, OSS-Security).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires authentication (low privileges), which somewhat limits the attack surface compared to unauthenticated flaws. The EPSS score is approximately 0.40% (Feedly data) to 1.294% (GitHub Advisory), placing it in the 80th percentile for exploitation probability within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has published a detection (ID: 5006273) for this vulnerability (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Apache Causeway applications (versions 2.0.0–3.4.0 or 4.0.0-M1) using web scanning tools or by inspecting Maven dependency manifests for affected packages (causeway-commons, causeway-applib, causeway-core, causeway-viewer-wicket).
2. Authenticate: Obtain valid application credentials — even low-privilege user accounts are sufficient to exploit this vulnerability.
3. Identify ViewModel endpoints: Navigate the application to locate pages or actions that use Causeway's ViewModel functionality, which serialize/deserialize state via URL parameters.
4. Craft malicious payload: Construct a serialized Java gadget chain payload (e.g., using tools like ysoserial) targeting a known deserialization gadget available in the application's classpath.
5. Inject via URL parameter: Encode the malicious serialized object and embed it in the user-controllable URL parameter associated with a ViewModel-backed page or action.
6. Trigger deserialization: Submit the crafted request to the application; the server deserializes the URL parameter, triggering the gadget chain and executing arbitrary code with application privileges (GitHub Advisory, OSS-Security).

• Network: Unusual or oversized URL parameters in HTTP requests to Causeway ViewModel endpoints; outbound connections from the application server to unexpected external hosts following such requests.
• Logs: Application server logs showing Java deserialization errors or unexpected class loading events; access logs with abnormally long or Base64-encoded URL parameters targeting ViewModel routes.
• Process: Unexpected child processes spawned by the Java application server process (e.g., bash, sh, curl, wget, python); unusual network connections initiated by the JVM process.
• File System: New or modified files in the application deployment directory, unexpected cron jobs, or scripts created by the application service account following suspicious requests.

The primary remediation is to upgrade Apache Causeway to version 3.5.0, which resolves the deserialization vulnerability. The fix is available across all affected Maven packages: causeway-commons, causeway-applib, causeway-core, and causeway-viewer-wicket. For organizations unable to upgrade immediately, recommended interim measures include restricting application access to trusted users, implementing additional input validation or a web application firewall (WAF) to filter malformed URL parameters, and monitoring for suspicious URL parameter usage. Note that version 4.0.0-M1 is also affected; users on that milestone should migrate to 3.5.0 or await a patched 4.x release (GitHub Advisory, Apache Mailing List).

The vulnerability was disclosed by Dan Haywood of the Apache Causeway project to the oss-security mailing list on November 19, 2025, crediting Slain Nico as the reporter (OSS-Security). Security news outlet SecurityOnline.info covered the disclosure, highlighting the RCE risk for authenticated users (Feedly). The vulnerability was also noted in Hawk-Eye's weekly threat landscape digest for Week 48 of 2025 and in Qualys's November 2025 application security detections publication, indicating moderate industry attention.