Apache Ignite: CVE-2018-8018, CVE-2018-1273, CVE-2018-1274: Notification on available mitigation

[Alexander Gerus <agerus () gridgain com>]

[CVE-2018-8018] Possible Execution of Arbitrary Code via Apache Ignite GridClientJdkMarshaller
Severity: Important
Vendor: GridGain Systems
Versions Affected:
GridGain Professional Edition 2.4.7 or earlier
GridGain Ultimate and Enterprise Editions 8.4.7 or earlier
Impact:
An attacker can execute arbitrary code on Ignite nodes via GridClientJdkMarshaller deserialization endpoint in the case 
when Ignite classpath contains arbitrary vulnerable classes. 

Description:
Apache Ignite serialization mechanism does not have a list of classes allowed for serialization/deserialization, which 
makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The 
vulnerability can be exploited if the one sends a specially prepared form of a serialized object to 
GridClientJdkMarshaller deserialization endpoint. 

Mitigation:
All GridGain versions: make sure there are no vulnerable classes among your custom code used in GridGain. 
Ignite Professional Edition 2.4.7 or earlier users: upgrade to Ignite 2.4.8 or later version
Ignite Ultimate and Enterprise Editions 8.4.7 or earlier users: upgrade to Ignite 8.4.8 or later version
After version upgrade use IGNITE_MARSHALLER_WHITELIST and/or IGNITE_MARSHALLER_BLACKLIST system properties to define 
classes allowed for deserialization. Refer to documentation for more details: 
https://apacheignite.readme.io/docs/securing-data-deserialization 
<https://apacheignite.readme.io/docs/securing-data-deserialization>
Credit:
The vulnerability was discovered by Man Yue Mo of lgtm.com
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8018 
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8018>

[CVE-2018-1273] [CVE-2018-1274] Apache Ignite impacted by security vulnerability in Spring Data Commons
Severity: Important
Vendor: GridGain Systems
Versions Affected:
GridGain Professional Edition 2.4.7 or earlier
GridGain Ultimate and Enterprise Editions 8.4.7 or earlier

Impact:
        An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST or Spring 
Data 

Description:
        Apache Ignite utilizes Spring Data Common library for some of its components. The vulnerability affects Apache 
Ignite users who us Spring Data REST for access an Ignite cluster via HTTP and Spring Data. Spring Data Commons, 
versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder 
vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or 
attacker) can supply specially crafted request parameters against 
        Spring Data REST backed HTTP resources or using Spring Data’s projection-based request payload binding hat can 
lead to a remote code execution attack.

Mitigation:
Ignite Professional Edition 2.4.7 or earlier users: upgrade to Ignite 2.4.8 or later version
Ignite Ultimate and Enterprise Editions 8.4.7 or earlier users: upgrade to Ignite 8.4.8 or later version
Credit:
Harendra Rai of NCR Corporation discovered the impact of the existing vulnerability on Apache Ignite. 
Reference:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1273 
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1273>
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1274 
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1274>

--
Alexander Gerus, On behalf of GridGain team.
E agerus () gridgain com
gridgain.com
Powered by Apache® Ignite™