CVE-2018-8018: Apache Ignite Ignite-core - Arbitrary Code Execution
Summary
CVE-2018-8018: Code execution via deserialization in org.apache.ignite:ignite-core. Affects org.apache.ignite:ignite-core versions < 2.6. Fixed in 2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ignite is an open-source distributed database, caching, and processing platform designed for high-performance computing and big data processing. The ignite-core package is a core component of Apache Ignite, providing essential functionality for data storage, processing, and communication within the Ignite cluster.
Vulnerability Detail
The vulnerability, identified as CVE-2018-8018, affects Apache Ignite versions 2.5 and earlier. It stems from a flaw in the serialization mechanism of Ignite, which lacks a list of allowed classes for serialization/deserialization. This oversight enables an attacker to execute arbitrary code by sending a specially crafted serialized object to the GridClientJdkMarshaller deserialization endpoint. Exploitation of this vulnerability is possible when third-party vulnerable classes are present in the Ignite classpath. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code within the context of the Ignite cluster, potentially leading to unauthorized access, data manipulation, or denial of service.
How To Fix
Minimum fixed version
2.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, it is advised to review and restrict the classpath of Ignite to only include trusted and necessary classes. By removing any unnecessary or potentially vulnerable third-party classes from the classpath, the attack surface for this vulnerability can be reduced. However, this workaround may not provide complete protection, and upgrading to a fixed version is still recommended.
Conclusion
The vulnerability in Apache Ignite Ignite-core (CVE-2018-8018) poses a critical risk due to the potential for arbitrary code execution. Upgrading to Apache Ignite version 2.6 or later is strongly recommended to address this vulnerability. Restricting the classpath and removing unnecessary third-party classes can provide a partial workaround, but it is not a comprehensive solution. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ignite:ignite-core →
FAQ
Apache Ignite is an open-source distributed database, caching, and processing platform designed for high-performance computing and big data processing. It provides in-memory storage, distributed data processing, and clustering capabilities.
The vulnerability allows an attacker to execute arbitrary code within the context of the Ignite cluster. This can lead to unauthorized access, data manipulation, or denial of service.
To fix this vulnerability, it is recommended to upgrade to Apache Ignite version 2.6 or later, which includes a fix for the serialization mechanism.
A workaround is to review and restrict the classpath of Ignite to only include trusted and necessary classes. However, upgrading to a fixed version is still the recommended solution.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to apply the necessary fixes to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ignite:ignite-core.
