Apache Helix: Deserialization vulnerability in Helix workflow and REST
CVE-2023-38647

9.8CRITICAL

Key Information:

Vendor
Apache
Status
Apache Helix
Vendor
CVE Published:
26 July 2023

Summary

A vulnerability in Apache Helix products allows an attacker to exploit SnakeYAML's deserialization process. This can lead to the loading of malicious JAR files from a specified URL through the java.net.URLClassLoader, and subsequently enables remote code execution via the javax.script.ScriptEngineManager. The affected versions include all prior to and including 1.2.0 in both helix-core and helix-rest, potentially compromising the integrity and security of the applications using these products. Users are advised to stop utilizing any YAML-based configurations temporarily and plan for an upgrade to version 1.3.0 or higher for long-term mitigation.

Affected Version(s)

Apache Helix 0 <= 1.2.0

References

https://lists.apache.org/thread/zyqxhv0lc2z9w3tgr8ttrdy2z...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Qing Xu
.