mcp-server-semgrep/semgrep-rules/java/lang/security/insecure-jms-deserialization.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-jms-deserialization
  severity: WARNING
  languages:
  - java
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    asvs:
      section: V5 Validation, Sanitization and Encoding
      control_id: 5.5.3 Insecue Deserialization
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention
      version: '4'
    references:
    - https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf
    category: security
    technology:
    - java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
  message: >-
    JMS Object messages depend on Java Serialization for marshalling/unmarshalling
    of the message payload when ObjectMessage.getObject() is called.
    Deserialization of untrusted data can lead to security flaws; a remote attacker
    could via a crafted JMS ObjectMessage to execute
    arbitrary code with the permissions of the application listening/consuming JMS
    Messages.
    In this case, the JMS MessageListener consume an ObjectMessage type received inside
    the onMessage method, which may lead to arbitrary code execution when calling
    the $Y.getObject method.
  patterns:
  - pattern-inside: |
      public class $JMS_LISTENER implements MessageListener {
        ...
        public void onMessage(Message $JMS_MSG) {
            ...
        }
      }
  - pattern-either:
    - pattern-inside: $X = $Y.getObject(...);
    - pattern-inside: $X = ($Z) $Y.getObject(...);