Clarification: V1.3.8 "JNDI injection attacks"
Open
@tghosth is already working on this.
Since Jul 30, 2025.
2) Awaiting response
V1 (prev V5)
- Dominant language
- HTML
- Stars
- 3.6k
- Forks
- 832
- Avg merge
- 7h 55m
- Merged PRs (30d)
- 4
Description
Verify that the application appropriately sanitizes untrusted input before use in Java Naming and Directory Interface (JNDI) queries and that JNDI is configured securely to prevent JNDI injection attacks.
The concept of injection prevention is universal and as per ASVS team the requirements are technology agnostic, but this requirement doesn't exist outside the Java ecosystem. This requirement is irrelevant, if similar risks exist other ecosystem.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.