Java Deserialization Protection

[PeteJacobCF]

Hello,

I am looking to enable the "Java Deserialization Protection" in my exploit profile.

I see the default is to leave it disabled.

anyone else have this enabled?

any advise or experience working with this?  

[eluis]

Hi @PeteJacobCF ,

Im not sure if your post is because your organization works with Spring Framework which is affected as you know by a recent reported vulnerability (see  CVE-2022-22965 for more information). 

If possitive to the former, we at PANW  highly recommend to upgrade your spring framework to the release/s 5.3.18 and 5.2.20 and also your Cortex XDR agents to the latest release, and more specifically to release 7.7and content above 470-88704.

If somebody tries to exploit this vulnerability , it will be blocked by the Java Deserialization Exploit protection module, which will be active if you enable Known Vulnerable Processes Protection at the Linux Exploit Security profile.

Please check that  "Known Vulnerable Processes Protection" module is set to block, so that exploitation attempt is blocked and you will get an alert  of the type Suspicious Input Deserialization.

Hope this helps, 

Luis

[PeteJacobCF]

@eluis thanks for the reply back man! I was just thinking that if its an available option now for windows if it would be good to enable it... I have read up on what it is but don't really understand fully what it is and what it does. I think for now I will just work on the "OpenSSL Infinite Loop Vulnerability" and put this on the back burner.  

[KanwarSingh01]

@PeteJacobCF If you have Java application using spring framework, i would assume it will be good to turn on this policy on your test system and work from there to implement to your live systems.