Object Instantiation Vulnerability in Amazon Redshift JDBC Driver
CVE-2022-41828
8.1HIGH
Key Information:
- Vendor
Amazon
- Vendor
- CVE Published:
- 29 September 2022
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2022-41828?
The Amazon Redshift JDBC Driver prior to version 2.1.0.8 contains a vulnerability in its Object Factory component. This issue arises because the driver does not validate the class type when creating instances based on provided class names. As a result, an attacker might exploit this flaw to instantiate arbitrary classes, potentially leading to unauthorized actions or data manipulation. Users are advised to upgrade to the latest version to mitigate any associated risks.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.