CVE-2020-17532: Arbitrary code execution in Apache ServiceComb java-chassis
Summary
CVE-2020-17532: Arbitrary code execution in Apache ServiceComb java-chassis. Affects org.apache.servicecomb:java-chassis across 2 version ranges.
>= 1.0.0, < 1.3.2
>= 2.0.0, < 2.1.5
Fixed in 1.3.2 or 2.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ServiceComb java-chassis is a framework that provides a set of tools and libraries for building microservices in Java. It offers features such as service registration and discovery, load balancing, and fault tolerance. The vulnerability identified as CVE-2020-17532 allows an authenticated user to inject malicious data and execute arbitrary code. This vulnerability affects versions 2.0.0 to 2.1.3 of Apache ServiceComb-Java-Chassis.
Vulnerability Detail
The vulnerability arises when the handler-router component is enabled in servicecomb-java-chassis. An authenticated user can exploit this vulnerability by injecting data, leading to arbitrary code execution. The impact of this vulnerability can be severe, as it allows an attacker to execute unauthorized code within the affected system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.3.21.3.2 -
>= 2.0.0, < 2.1.52.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version as soon as possible to eliminate the risk of arbitrary code execution.
Conclusion
The vulnerability CVE-2020-17532 in Apache ServiceComb java-chassis allows an authenticated user to execute arbitrary code. To mitigate this vulnerability, it is crucial to update to Apache ServiceComb-Java-Chassis version 2.1.5 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.servicecomb:java-chassis →
FAQ
Apache ServiceComb java-chassis is a framework for building microservices in Java, providing features like service registration, load balancing, and fault tolerance.
The vulnerability allows an authenticated user to execute arbitrary code, potentially leading to unauthorized access and control of the affected system.
Versions 2.0.0 to 2.1.3 of Apache ServiceComb-Java-Chassis are affected by this vulnerability.
To fix this vulnerability, update to Apache ServiceComb-Java-Chassis version 2.1.5 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
