CVE-2022-44645: Apache Linkis Deserialization of Untrusted Data
Summary
CVE-2022-44645: Apache Linkis contains Deserialization of Untrusted Data. Affects org.apache.linkis:linkis versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Linkis is an open-source project that provides a unified big data computing and scheduling platform. It allows users to submit and manage their big data jobs efficiently. The project is widely used in various industries for data processing and analysis. However, versions of Apache Linkis up to 1.3.0 are vulnerable to a deserialization vulnerability when used with the MySQL Connector/J. This vulnerability can be exploited by an attacker with write access to a database, who can configure a new datasource with a MySQL data source and malicious parameters. As a result, the parameters in the JDBC URL should be blacklisted to prevent this vulnerability.
Vulnerability Detail
The deserialization vulnerability in Apache Linkis <=1.3.0 allows for potential remote code execution. An attacker with write access to a database can exploit this vulnerability by configuring a new datasource with a MySQL data source and injecting malicious parameters. When the application attempts to deserialize the data source, the malicious code is executed, leading to remote code execution. This can have severe consequences, including unauthorized access, data leakage, and further exploitation of the compromised system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
1.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement a blacklist for the parameters in the JDBC URL. By identifying and blocking known malicious parameters, the risk of exploitation can be reduced. However, this is not a foolproof solution and should only be considered as a temporary measure until the upgrade to version 1.3.1 or later is completed.
Conclusion
The deserialization vulnerability in Apache Linkis <=1.3.0 poses a significant risk of remote code execution. It is crucial to upgrade to version 1.3.1 or later to mitigate this vulnerability. In the meantime, implementing a blacklist for the parameters in the JDBC URL can provide temporary protection. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.linkis:linkis →
FAQ
Apache Linkis is an open-source big data computing and scheduling platform used for managing and processing large datasets.
The vulnerability allows for potential remote code execution, which can lead to unauthorized access, data leakage, and further exploitation of the compromised system.
To fix this vulnerability, you should upgrade your Apache Linkis installation to version 1.3.1 or later.
As a temporary workaround, you can implement a blacklist for the parameters in the JDBC URL. However, this is not a foolproof solution and should only be considered as a temporary measure.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.linkis:linkis.
