{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-38647", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2023-07-21T17:22:07.744Z", "datePublished": "2023-07-26T07:52:29.741Z", "dateUpdated": "2023-07-26T07:52:29.741Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Helix", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.2.0", "status": "affected", "version": "0", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Qing Xu"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><span style=\"background-color: rgb(255, 255, 255);\">An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.</span><span style=\"background-color: rgb(255, 255, 255);\">ScriptEngineManager to load code using that ClassLoader. <span style=\"background-color: rgb(255, 255, 255);\">This unbounded deserialization can likely lead to remote code execution.&nbsp;</span>The code can be run in Helix REST start and Workflow creation.</span><br><span style=\"background-color: var(--wht);\"><br></span></p><p><span style=\"background-color: var(--wht);\">Affect all the versions lower and include 1.2.0.</span></p><p><span style=\"background-color: var(--wht);\">Affected products: helix-core, helix-rest</span></p><p><span style=\"background-color: var(--wht);\">Mitigation: Short term, stop using any YAML based configuration and workflow creation.</span><br><span style=\"background-color: var(--wht);\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Long term, all Helix version bumping up to 1.3.0&nbsp;</span><br></p>"}], "value": "An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution.\u00a0The code can be run in Helix REST start and Workflow creation.\n\nAffect all the versions lower and include 1.2.0.\n\nAffected products: helix-core, helix-rest\n\nMitigation: Short term, stop using any YAML based configuration and workflow creation.\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Long term, all Helix version bumping up to 1.3.0\u00a0\n\n"}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2023-07-26T07:52:29.741Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/zyqxhv0lc2z9w3tgr8ttrdy2zfh5jvc4"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Helix: Deserialization vulnerability in Helix workflow and REST", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:helix:*:*:*:*:*:*:*:*", "matchCriteriaId": "45C7A284-B3B0-4883-B43F-5325D8563A99", "versionEndExcluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution.\u00a0The code can be run in Helix REST start and Workflow creation.\n\nAffect all the versions lower and include 1.2.0.\n\nAffected products: helix-core, helix-rest\n\nMitigation: Short term, stop using any YAML based configuration and workflow creation.\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Long term, all Helix version bumping up to 1.3.0\u00a0\n\n"}], "id": "CVE-2023-38647", "lastModified": "2023-08-03T15:10:55.947", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-07-26T08:15:10.410", "references": [{"source": "security@apache.org", "tags": ["Mailing List"], "url": "https://lists.apache.org/thread/zyqxhv0lc2z9w3tgr8ttrdy2zfh5jvc4"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@apache.org", "type": "Primary"}]}

{}