Object Instantiation Vulnerability in Amazon Redshift JDBC Driver
CVE-2022-41828

8.1HIGH

Key Information:

Vendor

Amazon

Status
Amazon Web Services Redshift Java Database Connectivity Driver
Vendor
CVE Published:
29 September 2022

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 46%

What is CVE-2022-41828?

The Amazon Redshift JDBC Driver prior to version 2.1.0.8 contains a vulnerability in its Object Factory component. This issue arises because the driver does not validate the class type when creating instances based on provided class names. As a result, an attacker might exploit this flaw to instantiate arbitrary classes, potentially leading to unauthorized actions or data manipulation. Users are advised to upgrade to the latest version to mitigate any associated risks.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-41828
Created by murataydemir

References

https://github.com/aws/amazon-redshift-jdbc-driver/commit...
https://github.com/aws/amazon-redshift-jdbc-driver/securi...

EPSS Score

46% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.