CVE-2022-24289 Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions
An attacker with client access to the optional Remote Object Persistence feature can achieve arbitrary code execution via malicious Hessian payloads.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24289?
CVE-2022-24289 is a high-severity unsafe deserialization vulnerability in Apache Cayenne, published on 11 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and earlier, running on non-current patch versions of Java, an attacker with client access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This can result in arbitrary code execution.
Weakness: CWE-502
Which versions are affected by CVE-2022-24289?
2 open source packages ship an affected version, including org.apache.cayenne:cayenne-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.cayenne:cayenne-server Maven | All versions | 4.1.1 |
org.apache.cayenne:cayenne-server Maven | All versions | 4.1.1 |
Products include Apache Cayenne.
How do I fix CVE-2022-24289?
Upgrade org.apache.cayenne:cayenne-server to 4.1.1 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-24289 being exploited?
There is no known exploitation of CVE-2022-24289 in the wild and no public exploit code.
Other vulnerabilities in Apache Cayenne
Sources
Also known as GHSA-c58c-w527-h77p.