Deserialization of Untrusted Data Affecting software.amazon.jdbc:aws-advanced-jdbc-wrapper package, versions [3.3.0,4.0.1)

software.amazon.jdbc:aws-advanced-jdbc-wrapper is an Amazon Web Services (AWS) Advanced JDBC Wrapper

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the CachedResultSet deserialization path in the RemoteQueryCachePlugin. An attacker can execute arbitrary code on the application server by poisoning the shared Redis/Valkey cache with crafted serialized query results that are later read and deserialized by the driver. When the plugin reconstructs cached rows or result sets, it unmarshals untrusted cache data with ObjectInputStream and accepts attacker-controlled object graphs without class filtering. This impacts applications that enable the remote query cache and allow an untrusted or compromised principal to write to the shared cache, leading to server-side code execution when a victim application reads the poisoned entry.

Notes

• The plugin is not enabled by default; the vulnerable path is only reachable in deployments that turn on RemoteQueryCachePlugin and use the shared cache for query-result reuse.
• The cache lookup path accepts third-party application types when they are registered through Driver.skipWrappingForType() or Driver.skipWrappingForPackage(), so affected deployments may intentionally allow extra classes to deserialize from cache beyond the built-in JDBC types.

Workarounds

• Disable RemoteQueryCachePlugin on systems that cannot be upgraded yet, to stop the driver from reading and deserializing cached query results from the shared cache.
• Restrict write access to the Redis/Valkey cache infrastructure to trusted principals only, to prevent an attacker from poisoning cache entries with crafted serialized objects.

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

• AWS Security Advisory
• GitHub Commit 4.0.1
• Maintainer's Advisory