Maven Central

About

Maven Central is the main public repository for Java libraries, which Maven and Gradle builds download. Java products such as Confluence ship hundreds of these libraries inside them. A library deep in that tree runs with the whole application's rights, as Log4Shell showed.

Maven runs no install scripts, but build plugins run on the build server. Libraries run inside the app when it starts, so a flaw or bad code in one has the app's full rights.

If It Is Malicious

If a library from Maven Central is malicious, it runs inside a Java app with the app's rights, on every build server that fetches it and every server that runs the app.

Its code runs inside these technologies.

ConfluenceJiraSpringLog4jJava

See It in the Stack

Examples

These are well-known names from Maven Central, written as you would meet them in an inventory, an alert or a lockfile, the file that records every version a build installed.

log4j-core

The Log4j logging library, home of Log4Shell.

spring-core

The heart of the Spring framework.

jackson-databind

Turns JSON into Java objects, in a great many apps.

guava

Google's core libraries for Java.

commons-lang3

Apache helpers for everyday Java code.

How Bad Code Gets In

These are the ways bad code can reach your systems through Maven Central. None of them needs a flaw in your own code, so outside code needs checking as much as your own.

• A flaw in a library buried several levels down, as with Log4j, reaches every app that bundles it.
• A package under a look-alike group name catches careless builds.
• A build that also reads from other repositories can fetch the wrong copy of a name.
• A build plugin with bad code runs on the build server, next to its signing keys.

How to Check

These checks show what came from Maven Central, whether a known bad version is in use, and how to keep one out next time.

• Generate an SBOM for every build, so you can answer whether you use a library in minutes.
• Pin versions, and turn on Gradle dependency verification, which checks checksums and signatures.
• Run OWASP Dependency-Check or another scanner in the build, and watch OSV and GitHub advisories.
• Fetch through one repository manager, such as Nexus or Artifactory, that proxies Maven Central.
• Check the PGP signatures that Maven Central requires on every release.

Well-Known Incidents

Each incident below is a real case, told at the level of its public advisory. The tag says how the bad code got in, and the link opens the primary source.

• Vulnerable DependencyCVE-2021-442282021

  Log4Shell

  A flaw in the Log4j logging library let a single logged string make an app fetch and run remote code.

  Reach Log4j sat several levels down in the dependencies of countless Java apps and products, so many teams first had to search their builds to learn whether they ran it.

  Affectedlog4j-core

  Source: cisa.gov (opens in a new tab)

In Common Stacks

These common stacks take code from Maven Central. Open one to see where that code sits among its layers and who runs each one.

• Confluence, Java on Tomcat

Sources

• Sonatype: Maven Central publishing requirements (opens in a new tab)
• Gradle: verifying dependencies (opens in a new tab)
• OWASP Dependency-Check (opens in a new tab)