OWASP / OWASP/ASVS

Clarification: V1.3.8 "JNDI injection attacks"

Open
#3,220 36 comments 0 reactions 1 assignee View on GitHub

@tghosth is already working on this.

Since Jul 30, 2025.

2) Awaiting response V1 (prev V5)
Dominant language
HTML
Stars
3.6k
Forks
832
Avg merge
7h 55m
Merged PRs (30d)
4

Description

Verify that the application appropriately sanitizes untrusted input before use in Java Naming and Directory Interface (JNDI) queries and that JNDI is configured securely to prevent JNDI injection attacks.

The concept of injection prevention is universal and as per ASVS team the requirements are technology agnostic, but this requirement doesn't exist outside the Java ecosystem. This requirement is irrelevant, if similar risks exist other ecosystem.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.