CVE-2018-1297 Missing certificate validation in Apache JMeter
Attackers can execute unauthorized code via unsecured RMI connections in Apache JMeter when using Distributed Test mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1297?
CVE-2018-1297 is a critical code injection vulnerability in Apache JMeter, published on 13 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
Weakness: CWE-319
Which versions are affected by CVE-2018-1297?
2 open source packages ship an affected version, including org.apache.jmeter:ApacheJMeter. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.jmeter:ApacheJMeter Maven | All versions | 4.0 |
org.apache.jmeter:ApacheJMeter Maven | All versions | 4.0 |
Products include Apache Jmeter.
How do I fix CVE-2018-1297?
Upgrade org.apache.jmeter:ApacheJMeter to 4.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-1297 being exploited?
There is no known exploitation of CVE-2018-1297 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in Apache JMeter
Sources
Also known as DEBIAN-CVE-2018-1297, GHSA-7v85-6hv2-rwgw, UBUNTU-CVE-2018-1297.