Vulnerability · Published Jul 26, 2023 · Assigned by apache

CVE-2023-38647Apache Helix: Deserialization vulnerability in Helix workflow and REST

Critical 9.8

In plain English

A critical-severity unsafe deserialization in Apache Helix from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.0%top 19.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation. Affect all the versions lower and include 1.2.0. Affected products: helix-core, helix-rest Mitigation: Short term, stop using any YAML based configuration and workflow creation. Long term, all Helix version bumping up to 1.3.0

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.helix:helix-core	1.3.0	GHSA-jhcr-hph9-g7wm
Maven	org.apache.helix:helix-rest	1.3.0	GHSA-jhcr-hph9-g7wm

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Helix	0 – through 1.2.0

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://lists.apache.org/thread/zyqxhv0lc2z9w3tgr8ttrdy2zfh5jvc4 vendor-advisory