CVE-2024-22281 Apache Helix Front (UI): Helix front hard-coded secret in the express-session

What is CVE-2024-22281?

CVE-2024-22281 is a high-severity vulnerability in Apache Helix Front (UI), published on 20 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies.

This issue affects Apache Helix Front (UI): all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Weakness: CWE-668

Which versions are affected by CVE-2024-22281?

2 open source packages ship an affected version, including org.apache.helix:helix. It affects 1 product.

Products include Apache Helix.

How do I fix CVE-2024-22281?

No fix has been published for CVE-2024-22281 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-22281 being exploited?

There is no known exploitation of CVE-2024-22281 in the wild and no public exploit code.

Other vulnerabilities in Apache Helix Front (UI)

• CVE-2023-38647 Apache Helix: Deserialization vulnerability in Helix workflow and REST Critical 9.8
• CVE-2026-57111 Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin High 7.5
• CVE-2022-47500 Apache Helix: Open redirect Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6247-7862-q2pq.