CVE-2019-12017 Deserialization in MapR-MFS/CLDB
Remote attackers can execute arbitrary code and take over the cluster by exploiting unsafe JSON deserialization in MapR CLDB login handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-12017?
CVE-2019-12017 is a critical unsafe deserialization vulnerability in MapR-MFS/CLDB, published on 24 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handles login and ticket issuance. An attacker can use the 'class' property of the JSON request sent to the CLDB to influence the JSON library's decision on which Java class this JSON request is deserialized to. By doing so, the attacker can force the MapR CLDB to construct a URLClassLoader which loads a malicious Java class from a remote path and instantiate this object in the MapR CLDB, thus executing arbitrary code on the machine running the MapR CLDB and take over the cluster. By switching to the newer Jackson library and ensuring that all incoming JSON requests are only deserialized to the same class that it was serialized from, the vulnerability is fixed. This vulnerability affects the entire MapR core platform.
Weakness: CWE-502
Which versions are affected by CVE-2019-12017?
It affects 1 product.
Products include Mapr Mapr.
How do I fix CVE-2019-12017?
No fix has been published for CVE-2019-12017 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-12017 being exploited?
There is no known exploitation of CVE-2019-12017 in the wild and no public exploit code.
Other vulnerabilities in MapR-MFS/CLDB
Sources
Also known as GHSA-6hmp-55x3-9hvc.