Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order

TL;DR

Maven-Hijack reveals a novel software supply chain attack in Java ecosystems that exploits Maven's dependency packaging order and the JVM's runtime class-loading behavior to shadow legitimate classes without modifying code. The authors provide a working PoC on the Corona-Warn-App, demonstrating how an infection dependency can precede a gadget dependency to hijack critical startup logic such as database initialization. They evaluate mitigations—Sealed JARs, Java Modules, and the Maven Enforcer plugin—and find that, while each helps, the Enforcer plugin offers the most practical protection for current Maven workflows. The work emphasizes urgent needs for stronger safeguards in build and dependency management and suggests directions for automated detection of packaging-order tampering and broader adoption of robust enforcement mechanisms.

Abstract

Java projects frequently rely on package managers such as Maven to manage complex webs of external dependencies. While these tools streamline development, they also introduce subtle risks to the software supply chain. In this paper, we present Maven-Hijack, a novel attack that exploits the order in which Maven packages dependencies and the way the Java Virtual Machine resolves classes at runtime. By injecting a malicious class with the same fully qualified name as a legitimate one into a dependency that is packaged earlier, an attacker can silently override core application behavior without modifying the main codebase or library names. We demonstrate the real-world feasibility of this attack by compromising the Corona-Warn-App, a widely used open-source COVID-19 contact tracing system, and gaining control over its database connection logic. We evaluate three mitigation strategies, such as sealed JARs, Java Modules, and the Maven Enforcer plugin. Our results show that, while Java Modules offer strong protection, the Maven Enforcer plugin with duplicate class detection provides the most practical and effective defense for current Java projects. These findings highlight the urgent need for improved safeguards in Java's build and dependency management processes to prevent stealthy supply chain attacks.

Figures (3)

• Figure 1: Overview of the Maven-Hijack attack.
• Figure 2: Resolved dependency tree of a sample Maven project showing its direct and transitive dependencies.
• Figure 3: Truncated dependency tree for Corona-Warn-App backend service, from the parent pom.xml file