PT-2019-12628 · Mapr+1 · Mapr Core Platform+1
Published
2019-10-24
·
Updated
2020-08-24
·
CVE-2019-12017
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
MapR core platform (affected versions not specified)
Description
A remote code execution issue exists in the MapR CLDB code, specifically in the JSON framework used for login and ticket issuance. An attacker can manipulate the
class property of a JSON request to influence the JSON library's deserialization decision, forcing the MapR CLDB to load a malicious Java class from a remote path and execute arbitrary code on the machine running the MapR CLDB, potentially taking over the cluster.Recommendations
To resolve this issue, switch to the newer Jackson library and ensure that all incoming JSON requests are only deserialized to the same class that it was serialized from.
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jackson Library
Mapr Core Platform