CVE-2024-52577

Published Feb 14, 2025

Last updated a year ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-52577 is a remote code execution (RCE) vulnerability found in Apache Ignite, an open-source distributed database and computing platform. This flaw stems from insecure deserialization, where certain Ignite endpoints fail to properly enforce configured Class Serialization Filters. This oversight allows an attacker to bypass existing security mechanisms designed to prevent the deserialization of untrusted objects. By crafting a malicious Ignite message containing a serialized object, an attacker can exploit this vulnerability. If the server's classpath includes a "gadget class" corresponding to the malicious object, the deserialization process will execute arbitrary code on the Apache Ignite server. This issue impacts Apache Ignite versions 2.6.0 through 2.16.x.

Description: In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.
Source: security@apache.org
NVD status: Analyzed
Products: ignite

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.5
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Primary
Base score: 9
Impact score: 6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@apache.org: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0BE730D0-7E35-4AF8-98E0-23898D8F4FCB",
            "versionEndExcluding": "2.17.0",
            "versionStartIncluding": "2.6.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.