[
https://issues.apache.org/jira/browse/IGNITE-6643?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ilya Kasnacheev updated IGNITE-6643:
------------------------------------
Component/s: (was: security)
binary
> Exploitable unsafe deserialization in Ignite cluster
> ----------------------------------------------------
>
> Key: IGNITE-6643
> URL: https://issues.apache.org/jira/browse/IGNITE-6643
> Project: Ignite
> Issue Type: Bug
> Components: binary
> Reporter: Denis A. Magda
> Assignee: Denis A. Magda
> Priority: Blocker
> Labels: vulnerability
> Fix For: 2.4
>
> Attachments: ExampleNodeExploit.java, obj
>
>
> The security breach was reported by an end-user:
> https://mail-search.apache.org/pmc/private-arch/ignite-private/201710.mbox/%[email protected]%3e
> This unsafe deserialization here can be used to attack any ignite node (not
> require other pluggins enabled), happened during an incoming packet is parsed
> (so probably pre-authentication) and can be attacked through the standard
> ignite port (47500).
> 1. Start an ignite node e.g. with 'examples/config/example-ignite.xml'.
> 2. Run `ExampleNodeExploit` to send a malicious packet.
> Remote code execution will happen when:
> https://lgtm.com/projects/g/apache/ignite/latest/files/modules/core/src/main/java/org/apache/ignite/spi/discovery/tcp/ServerImpl.java?sort=name&dir=ASC&mode=list#L5771
> calls the `JdkMarshaller` to deserializer the packet data. (The logging in
> line 5760 also shows that this is a plausible scenario)This is easily
> prevented as you know at compile time that this data is supposed to be an
> instance of `TcpDiscoveryAbstractMessage`, so checking the type and prevent
> unsafe deserialization in this case is fairly straightforward.
> Please let me know if you need help or more information. Thanks.
> *Vulnerabilities resolution process:*
> https://www.apache.org/security/committers.html
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
