VNX-937: Build file pins a Java library release with a known remote-code-execution vulnerability

Reports a Maven or Gradle build file pinning log4j-core before 2.16.0, log4j 1.x, commons-collections 3.2.1 or earlier, commons-collections4 4.0 or commons-text 1.5 to 1.9.

Field	Value
Rule ID	`VNX-937`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Java, Kotlin
CWE	CWE-937
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`known-vulnerable-component` `dependency` `cwe-937`
Source	`internal/sast/rules/vnx-937.rego`

Overview

VNX-937 maps to CWE-937: OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities. Dependency scanning (vulnetix sca) is the complete check for this category. This rule is a narrow, offline guard for the Java components whose vulnerable releases are exploited for remote code execution, read from pom.xml, build.gradle, build.gradle.kts and Gradle version catalogs (*.versions.toml).

Component	Reported versions	Why
`org.apache.logging.log4j:log4j-core`	2.x before 2.16.0 (2.12.2+ and 2.3.1+ are fixed branches)	Log4Shell, CVE-2021-44228 / CVE-2021-45046
`log4j:log4j`	1.x	End of life; CVE-2019-17571, CVE-2022-23305
`commons-collections:commons-collections`	3.0 to 3.2.1	Deserialization gadget chain, CVE-2015-7501
`org.apache.commons:commons-collections4`	4.0	Deserialization gadget chain
`org.apache.commons:commons-text`	1.5 to 1.9	Text4Shell, CVE-2022-42889

What Gets Flagged

<dependency>
  <groupId>org.apache.logging.log4j</groupId>
  <artifactId>log4j-core</artifactId>
  <version>2.14.1</version>          <!-- flagged; ${log4j2.version} resolved from <properties> too -->
</dependency>

implementation 'org.apache.logging.log4j:log4j-core:2.11.2'                                    // flagged
runtimeOnly group: 'commons-collections', name: 'commons-collections', version: '3.2.1'         // flagged
ext { log4jVersion = '2.14.1' }
implementation "org.apache.logging.log4j:log4j-core:${log4jVersion}"                           // flagged (also from gradle.properties)

log4j-core = { module = "org.apache.logging.log4j:log4j-core", version = "2.14.0" }            # flagged
log4j-core = { module = "org.apache.logging.log4j:log4j-core", version.ref = "log4j" }         # flagged when [versions] log4j = "2.14.1"

Not flagged: fixed releases, unaffected artifacts of the same project (log4j-api, log4j-to-slf4j, log4j-over-slf4j), the same artifactId under a different groupId, exclusions, dependencies whose version is managed by a parent pom, a BOM, a plugin or a variable defined in another build script, coordinates in source code, comments and documentation.

Remediation

Upgrade: log4j-core 2.17.1 or later, commons-collections 3.2.2, commons-collections4 4.1+, commons-text 1.10.0+, and migrate off log4j 1.x. Run vulnetix sca for every other known-vulnerable dependency.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-937
// nosec vnx-937

Or record an ignore rule: vulnetix ignore add --rule vnx-937 --reason "...". See Suppressing findings.