GHSA-3cxh-xp3g-jxjm

Source

https://github.com/advisories/GHSA-3cxh-xp3g-jxjm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-3cxh-xp3g-jxjm/GHSA-3cxh-xp3g-jxjm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3cxh-xp3g-jxjm

Aliases

CVE-2023-28754

Published

2023-07-19T09:30:54Z

Modified

2024-02-16T08:24:33Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache ShardingSphere-Agent Deserialization of Untrusted Data vulnerability

Details

Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML configuration file.

The attacker needs to have permission to modify the ShardingSphere Agent YAML configuration file on the target machine, and the target machine can access the URL with the arbitrary code JAR. An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. When the ShardingSphere JVM process starts and uses the ShardingSphere-Agent, the arbitrary code specified by the attacker will be executed during the deserialization of the YAML configuration file by the Agent.

This issue affects ShardingSphere-Agent: through 5.3.2. This vulnerability is fixed in Apache ShardingSphere 5.4.0.

Database specific

{
    "cwe_ids":  [
        "CWE-502"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-07-20T10:10:02Z",
    "nvd_published_at":  "2023-07-19T08:15:10Z",
    "severity":  "HIGH"
}

References

Affected packages

Maven / org.apache.shardingsphere:shardingsphere

Package

Name: org.apache.shardingsphere:shardingsphere; View open source insights on deps.dev
Purl: pkg:maven/org.apache.shardingsphere/shardingsphere

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.4.0

Affected versions

4.*

4.0.0-RC1

4.0.0-RC2

4.0.0-RC3

4.0.0

4.0.1

4.1.0

4.1.1

5.*

5.0.0-alpha

5.0.0-beta

5.0.0

5.1.0

5.1.1

5.1.2

5.2.0

5.2.1

5.3.0

5.3.1

5.3.2

Database specific

last_known_affected_version_range

"<= 5.3.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-3cxh-xp3g-jxjm/GHSA-3cxh-xp3g-jxjm.json"