CVE-2020-5529: Code Injection
HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/net.sourceforge.htmlunit:htmlunitto a version that resolves this vulnerability.Fixed in 2.37.0 - Upgrade
Upgrade
HtmlUnitto a version that resolves this vulnerability.Fixed in 2.37.0 - Configuration
Update the Android-specific Rhino engine initialization in the embedded HtmlUnit integration so it is done properly, preventing malicious JavaScript from executing arbitrary Java code on the application.
Android application embedding HtmlUnit (Rhino engine initialization) Rhino engine Android-specific initialization = properly initialized
Event History
Frequently Asked Questions
What is the vulnerability ID for this code execution vulnerability?
The vulnerability ID for this code execution vulnerability is CVE-2020-5529.
What is the severity score for CVE-2020-5529?
The severity score for CVE-2020-5529 is 8.1 (high).
What is the affected software for CVE-2020-5529?
The affected software for CVE-2020-5529 includes HtmlUnit prior to version 2.37.0, Htmlunit Project Htmlunit, Debian Debian Linux 9.0, and Canonical Ubuntu Linux 16.04.
How does this vulnerability allow code execution?
This vulnerability allows code execution by improperly initializing the Rhino engine in HtmlUnit, which enables the execution of arbitrary Java code on the application.
Is there a fix available for CVE-2020-5529?
Yes, the fix for CVE-2020-5529 is available in HtmlUnit version 2.37.0. It is recommended to update to this version to mitigate the vulnerability.