CVE-2025-48734

What it actually does

This vulnerability is an improper access-control issue in Apache Commons BeanUtils property introspection. Applications that pass externally controlled property paths directly into PropertyUtilsBean.getProperty(), PropertyUtilsBean.getNestedProperty(), or BeanUtilsBean equivalents may allow an attacker to reference the declaredClass property on Java enum objects. In vulnerable versions, that property is not suppressed by default, which can expose the enum Class object and ClassLoader. In unsafe application designs where the returned object graph is further usable for reflective access, expression evaluation, object manipulation, or gadget interaction, this can become arbitrary code execution in the context of the Java application process. The vulnerable library ranges are commons-beanutils:commons-beanutils 1.x before 1.11.0 and org.apache.commons:commons-beanutils2 2.x before 2.0.0-M2.

Why it matters to the business

Successful exploitation can let an unauthenticated or low-privileged attacker take control of an affected Java application if that application exposes BeanUtils property-path access to untrusted input. Consequences may include application compromise, data theft, credential exposure, lateral movement from the application server, service disruption, and deployment of malicious code. The CVSS score is high, but the EPSS score is currently low and it is not listed in CISA KEV, so prioritization should focus first on internet-facing Java applications and services that actually use Commons BeanUtils with user-controlled property paths. Because Commons BeanUtils is widely embedded as a transitive dependency in Java applications and frameworks, exposure may exist even when engineering teams did not intentionally add it.

How an attack unfolds

An attacker first identifies an application endpoint that accepts a property name, field selector, sort key, filter, binding path, template variable, or similar user-controlled value and passes it into Apache Commons BeanUtils property-access APIs. The attacker then supplies a crafted property path that attempts to traverse through an enum object using the declaredClass property. On vulnerable versions, BeanUtils exposes that declaredClass property instead of suppressing it. The attacker uses the resulting Class and ClassLoader access as a pivot into reflection or application-specific object handling. If the surrounding application allows the returned object to influence method invocation, expression evaluation, deserialization, template resolution, scripting, or other dynamic behavior, the attacker can execute code under the Java process identity. There is no CISA KEV listing and no exploit maturity reported in the input, so current intelligence supports proactive remediation and exposure hunting rather than assuming broad commodity exploitation.

How to fix it

Upgrade Apache Commons BeanUtils wherever it is present, including transitive dependencies. For the 1.x artifact commons-beanutils:commons-beanutils, upgrade to version 1.11.0 or later. For the 2.x artifact org.apache.commons:commons-beanutils2, upgrade to version 2.0.0-M2 or later. Ensure the new BeanIntrospector behavior that suppresses declaredClass is enabled; do not disable it to preserve legacy behavior unless compensating controls fully prevent untrusted property paths. If immediate upgrade is not possible, block or strictly allowlist externally supplied property paths before they reach BeanUtils APIs, reject declaredClass, classLoader, class, and nested variants, and avoid using BeanUtils on untrusted object graphs. Review application code for calls to PropertyUtilsBean.getProperty(), PropertyUtilsBean.getNestedProperty(), BeanUtilsBean.getProperty(), and related binding helpers. The supplied package metadata also lists Ubuntu snapd fixed versions 2.37.4~14.04.1 for Ubuntu 14.04 LTS and 2.37.4ubuntu0.1 for Ubuntu 16.04 LTS; validate advisory applicability before treating those OS package mappings as equivalent to the Commons BeanUtils Java library fix.

How to confirm the fix worked

Confirm dependency versions with software composition analysis, build manifests, Maven/Gradle dependency trees, SBOMs, container image scans, and runtime classpath inspection. Verify that no deployed artifact contains commons-beanutils versions earlier than 1.11.0 or commons-beanutils2 versions earlier than 2.0.0-M2. Add regression tests that pass declaredClass, .declaredClass, declaredClass.classLoader, class.classLoader, and nested equivalents into any exposed property-path handling and confirm they are rejected or unavailable. Review configuration and code to ensure the BeanIntrospector that suppresses declaredClass has not been disabled. For running systems, inspect packaged JARs and classpaths for vulnerable JAR names, and validate that internet-facing endpoints do not accept arbitrary property paths that are passed directly into BeanUtils.

Typical attack path

1. Find a Java application endpoint that accepts externally supplied property paths, object field names, nested property expressions, filters, sort parameters, binding paths, or template variables.
2. Determine that the backend uses Apache Commons BeanUtils PropertyUtilsBean, BeanUtilsBean, getProperty(), or getNestedProperty() on attacker-controlled input.
3. Submit probes containing enum-property traversal terms such as declaredClass and classLoader to confirm whether blocked or reflected errors differ from normal property-access failures.
4. Craft a property path that accesses an enum object's declaredClass property on a vulnerable BeanUtils version.
5. Use the exposed Class or ClassLoader as a pivot into application-specific reflective behavior, expression evaluation, template evaluation, or other dynamic code paths.
6. Execute code or load attacker-controlled functionality in the Java application process if the surrounding application design permits it.
7. Use the compromised process to access application secrets, databases, internal services, files, or to establish persistence.

How to detect it

To determine whether exploitation has already been attempted, review application access logs, API gateway logs, WAF logs, reverse proxy logs, Java application logs, exception traces, and security telemetry for requests containing declaredClass, classLoader, or nested property-path syntax. Focus on endpoints that accept field names, filters, sort keys, binding paths, object properties, report columns, template variables, or JSON/XML form parameters. Look for Java exceptions from Apache Commons BeanUtils, reflection, property resolution, expression-language engines, template engines, or class loading around the same request timestamps. Investigate any unexpected child processes spawned by Java application processes, new or modified files in application deployment directories, suspicious temporary JAR/class files, outbound connections from Java processes, or credential access following suspicious property-path probes. Because generic terms such as class and classLoader may appear in benign developer traffic, correlate indicators with vulnerable BeanUtils versions, endpoint behavior, unusual source IPs, repeated probing, HTTP 500 responses, and subsequent runtime anomalies.

• declaredClass
• declaredClass.classLoader
• .declaredClass
• [declaredClass]
• %64%65%63%6c%61%72%65%64%43%6c%61%73%73
• classLoader
• class.classLoader
• java.lang.ClassLoader
• org.apache.commons.beanutils.PropertyUtilsBean.getProperty
• org.apache.commons.beanutils.PropertyUtilsBean.getNestedProperty
• org.apache.commons.beanutils.BeanUtilsBean.getProperty
• NoSuchMethodException: Unknown property 'declaredClass'
• IllegalAccessException
• InvocationTargetException
• commons-beanutils-1.9
• commons-beanutils-1.9.0.jar
• commons-beanutils-1.9.1.jar
• commons-beanutils-1.9.2.jar
• commons-beanutils-1.9.3.jar
• commons-beanutils-1.9.4.jar
• commons-beanutils-1.10
• commons-beanutils-1.10.0.jar
• commons-beanutils2-2.0.0-M1.jar

What your security team should do

• Inventory all Java applications, containers, and build artifacts for Apache Commons BeanUtils, including transitive dependencies and shaded JARs.
• Prioritize remediation for internet-facing applications, administrative consoles, APIs, workflow engines, template-driven applications, and services that accept dynamic field or property names from users.
• Upgrade commons-beanutils:commons-beanutils to 1.11.0 or later and org.apache.commons:commons-beanutils2 to 2.0.0-M2 or later.
• Search source code for PropertyUtilsBean.getProperty, PropertyUtilsBean.getNestedProperty, BeanUtilsBean.getProperty, BeanUtilsBean.populate, and custom wrappers that process untrusted property paths.
• Implement allowlists for user-selectable fields and reject introspection-related terms such as declaredClass, classLoader, and class in externally supplied property paths.
• Add WAF, API gateway, or application-layer detections for suspicious property-path probes while upgrades are deployed, but do not rely on filtering as the primary fix.
• Review logs for historical probes or exploitation attempts containing declaredClass and classLoader, especially on endpoints that return binding, reflection, template, or property-access errors.
• Monitor vendor advisories and dependency updates because the issue may be inherited through frameworks or products that bundle Commons BeanUtils.