commons-beanutils: Improper Access Control in Apache Commons BeanUtils allowing unauthorized enum property access (CVE-2025-48734) #shorts

Summary

Welcome to our security podcast. Today we cover CVE-2025-48734, a critical improper access control vulnerability in Apache Commons BeanUtils. Attackers can exploit this flaw to load arbitrary classes and execute code remotely.

Product details

The issue affects Apache Commons BeanUtils versions 1.x prior to 1.11.0 and 2.x prior to 2.0.0-M2. BeanUtils is a popular Java library for working with properties on JavaBeans, used widely in enterprise applications and frameworks.

Vulnerability type summary

CVE-2025-48734 is classified as CWE-284, Improper Access Control. It allows unauthorized access to internal classloader functionality by abusing enum property access in the library’s PropertyUtilsBean.

Details of the vulnerability

In BeanUtils versions before the fix, passing uncontrolled property paths to PropertyUtilsBean.getProperty() or getNestedProperty() allows an attacker to reference the “declaredClass” property on any Java enum. By retrieving the enum’s declaredClass, the attacker gains access to the ClassLoader and can load or execute arbitrary code. Although a protective BeanIntrospector was introduced in version 1.9.2, it wasn’t enabled by default until releases 1.11.0 and 2.0.0-M2. Starting in those versions, the declaredClass property is suppressed unless explicitly reenabled.

Conclusion

To mitigate CVE-2025-48734, upgrade commons-beanutils to 1.11.0 or commons-beanutils2 to 2.0.0-M2. Distributions like Fedora 41 and 42 have already patched this issue. Review your application’s dependencies, apply updates, and avoid passing untrusted property paths directly into BeanUtils methods.

Watch the full video on YouTube: CVE-2025-48734

Remediation and exploitation details

This chain involves the following actors

  • Remote Attacker: Crafts and submits malicious property paths to gain unauthorized access
  • Application Developer: Builds and maintains the application that uses BeanUtils
  • Application Administrator: Manages library versions and configures security settings

This following systems are involved

  • Web Application (Exposes an endpoint that uses BeanUtils to resolve property paths on server-side objects): Victim system that forwards external input into BeanUtils
  • Apache Commons BeanUtils (Performs Java bean introspection and property access at runtime): Library containing the improper access control vulnerability

Attack entry point

  • Property Path Parameter: An HTTP query or form field whose value is passed directly into BeanUtils.getProperty() or getNestedProperty()

Remediation actions

Application Developer
Upgrade Apache Commons BeanUtils to version 1.11.0 (for 1.x) or 2.0.0-M2 (for 2.x)
Apache Commons BeanUtils
Application Administrator
Ensure the default BeanIntrospector is enabled so the 'declaredClass' property is suppressed
Apache Commons BeanUtils
Application Developer
Validate or sanitize any external property path inputs before passing them to BeanUtils APIs
Web Application

Exploitation actions

Reconnaissance of exposed property names

Remote Attacker
Identify an enum property in the application model (for example, a status field of enumeration type)
Web Application
Examples:
  • Inspect response pages or API schemas for an enum field named 'status'

Append '.declaredClass.classLoader' to the known enum field

Remote Attacker
Craft a property path that navigates through the enum’s internal declaredClass property
Web Application
Examples:
  • status.declaredClass.classLoader

Uncontrolled invocation of getProperty() returns the ClassLoader object

Remote Attacker
Send the malicious path to the server endpoint that invokes BeanUtils.getProperty()
Apache Commons BeanUtils
Examples:
  • GET /api/getProperty?path=status.declaredClass.classLoader

Call loadClass on the obtained ClassLoader instance

Remote Attacker
Use the returned class loader object to load a remote or local malicious class
Web Application
Examples:
  • classLoader.loadClass('com.evil.Payload')

Invoke newInstance() or similar factory method on the payload class

Remote Attacker
Instantiate the loaded class to trigger execution of arbitrary code
Web Application
Examples:
  • Payload.class.newInstance()

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2025-48734
Description
Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests. This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils 1.x are recommended to upgrade to version 1.11.0, which fixes the issue. Users of the artifact org.apache.commons:commons-beanutils2 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.
Provider
apache
CWE / problem types
CWE-284 Improper Access Control
Affected Software Versions
Apache Software Foundation:Apache Commons BeanUtils 1.x:[{'lessThan': '1.11.0', 'status': 'affected', 'version': '1.0', 'versionType': 'maven'}],Apache Software Foundation:Apache Commons BeanUtils 2.x:[{'lessThan': '2.0.0-M2', 'status': 'affected', 'version': '2.0.0-M1', 'versionType': 'maven'}]
Date Published
2025-05-28T13:32:08.300Z
Last Updated
2025-05-29T03:55:47.725Z