PT-2023-21940 · Apache+1 · Shardingsphere-Agent+1

Liav Gutman

·

Published

2023-07-19

·

Updated

2024-10-02

·

CVE-2023-28754

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ShardingSphere-Agent versions through 5.3.2
Description The Deserialization of Untrusted Data issue in Apache ShardingSphere-Agent allows attackers to execute arbitrary code by constructing a special YAML configuration file. An attacker must have permission to modify the ShardingSphere Agent YAML configuration file on the target machine, and the target machine must be able to access the URL with the arbitrary code JAR. The attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. When the ShardingSphere JVM process starts and uses the ShardingSphere-Agent, the arbitrary code specified by the attacker will be executed during the deserialization of the YAML configuration file by the Agent.
Recommendations For ShardingSphere-Agent versions through 5.3.2, update to Apache ShardingSphere 5.4.0 to fix the vulnerability. As a temporary workaround, consider restricting access to the ShardingSphere Agent YAML configuration file to prevent modification by unauthorized users. Additionally, restrict the target machine's access to URLs with arbitrary code JARs to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-28754
GHSA-3CXH-XP3G-JXJM

Affected Products

Java
Shardingsphere-Agent