GHSA-3w6p-8f82-gw8r Using JMSAppender in log4j configuration may lead to deserialization of untrusted data
Remote attackers can execute code if the ClickHouse JDBC Bridge uses a non-default log4j configuration with JMSAppender and an insecure broker.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3w6p-8f82-gw8r?
GHSA-3w6p-8f82-gw8r is an unsafe deserialization vulnerability in ru.yandex.clickhouse:clickhouse-jdbc-bridge, published on 17 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
ClickHouse JDBC Bridge uses slf4j-log4j12 1.7.32, which depends on log4j 1.2.17. It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker.
Patches
The patch version 2.0.7 removed log4j dependency by replacing slf4j-log4j12 to slf4j-jdk14. Logging configuration is also changed from log4j.properties to logging.properties.
Workarounds
- Do NOT change log4j configuration to use JMSAppender along with insecure JMS broker
- Alternatively, you can issue below command to remove
JMSAppender.class:
# install zip command if you don't have
apt-get update && apt-get install -y zip
# remove the class
zip -d clickhouse-jdbc-bridge*.jar ru/yandex/clickhouse/jdbcbridge/internal/log4j/net/JMSAppender.class
References
Please refer to CVE-2021-4104 to read more.
For more information
If you have any questions or comments about this advisory, please feel free to open an issue in the repository.
Which versions are affected by GHSA-3w6p-8f82-gw8r?
2 open source packages ship an affected version, including ru.yandex.clickhouse:clickhouse-jdbc-bridge.
| Package | Affected | Fixed in |
|---|---|---|
ru.yandex.clickhouse:clickhouse-jdbc-bridge Maven | All versions | 2.0.7 |
ru.yandex.clickhouse:clickhouse-jdbc-bridge Maven | All versions | 2.0.7 |
How do I fix GHSA-3w6p-8f82-gw8r?
Upgrade ru.yandex.clickhouse:clickhouse-jdbc-bridge to 2.0.7 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is GHSA-3w6p-8f82-gw8r being exploited?
There is no known exploitation of GHSA-3w6p-8f82-gw8r in the wild and no public exploit code.