CVE-2024-43383 Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator
An attacker can achieve remote code execution by intercepting replication traffic and sending malicious JSON payloads to the Lucene.NET Replicator library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43383?
CVE-2024-43383 is a high-severity unsafe deserialization vulnerability in Apache Lucene.Net.Replicator, published on 31 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator.
This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016.
An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access.
Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue.
Weakness: CWE-502
Which versions are affected by CVE-2024-43383?
2 open source packages ship an affected version, including Lucene.Net.Replicator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Lucene.Net.Replicator NuGet | From 4.8.0-beta00005 | 4.8.0-beta00017 |
Lucene.Net.Replicator NuGet | From 4.8.0-beta00005 | 4.8.0-beta00017 |
Products include Apache Lucene.net.
How do I fix CVE-2024-43383?
Upgrade Lucene.Net.Replicator to 4.8.0-beta00017 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-43383 being exploited?
There is no known exploitation of CVE-2024-43383 in the wild and no public exploit code.
Other vulnerabilities in Apache Lucene.Net.Replicator
- CVE-2026-47896 Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server
- CVE-2026-47897 Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client
- CVE-2026-47898 Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser
Sources
Also known as GHSA-2qw8-ppr5-m96c.