CVE-2023-45860: Hazelcast Platform permission checking in CSV File Source connector
Summary
CVE-2023-45860: Hazelcast Platform permission checking in CSV File Source connector. Affects com.hazelcast:hazelcast across 3 version ranges.
< 5.1.7
>= 5.2.0, < 5.2.5
>= 5.3.0, < 5.3.5
Fixed in 5.1.7, 5.2.5 or 5.3.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hazelcast Platform is an open-source in-memory computing platform that provides distributed data storage and processing capabilities. It allows users to store and retrieve data in a distributed manner across multiple nodes. The CSV File Source connector is a component of Hazelcast Platform that enables reading data from CSV files and processing it within the platform.
Vulnerability Detail
The Hazelcast Platform through version 5.3.4 is affected by a security vulnerability in the SQL mapping for the CSV File Source connector. This vulnerability arises from inadequate permission checking, which could potentially allow unauthorized clients to access data from files stored on a member's filesystem. This means that an attacker could exploit this vulnerability to read sensitive data from CSV files that are accessible to the Hazelcast Platform.
How To Fix
Latest published version: 5.7.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.1.75.1.7 -
>= 5.2.0, < 5.2.55.2.5 -
>= 5.3.0, < 5.3.55.3.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround is to disable the Hazelcast Jet processing engine in the Hazelcast member configuration. This can be done by modifying the configuration file to exclude the Jet module. However, it's important to note that by disabling the Hazelcast Jet processing engine, SQL and Jet jobs will not work until the vulnerability is properly fixed.
Conclusion
In conclusion, the Hazelcast Platform through version 5.3.4 is vulnerable to unauthorized access to data from CSV files due to inadequate permission checking in the CSV File Source connector. To mitigate this vulnerability, it is recommended to upgrade to the fixed versions: 5.3.5 or 5.4.0-BETA-1. Alternatively, the Hazelcast Jet processing engine can be temporarily disabled as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.hazelcast:hazelcast →
FAQ
The vulnerability allows unauthorized clients to access data from files stored on a member's filesystem. This can lead to the exposure of sensitive information and potential data breaches.
The vulnerability affects Hazelcast Platform versions up to and including 5.3.4.
There are no known exploits for this vulnerability at the time of this advisory.
Yes, the CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
You can find more information about this vulnerability in the GitHub Advisory Database at the provided source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.hazelcast:hazelcast.
