Java Applications Vulnerable to Remote Code Execution due to a Critical Bug in Apache Avro SDK

Oct 07, 2024Ravie LakshmananOpen Source / Software Security

An unexpected security vulnerability has been revealed in the Apache Avro Java Software Development Kit (SDK) that could potentially allow the arbitrary execution of code on vulnerab

Oct 07, 2024Ravie LakshmananOpen Source / Software Security

Critical Apache Avro SDK Flaw Allows Remote Code Execution in Java Applications

An unexpected security vulnerability has been revealed in the Apache Avro Java Software Development Kit (SDK) that could potentially allow the arbitrary execution of code on vulnerable instances.

The bug, identified as CVE-2024-47561, affects all software versions released before 1.11.4.

According to information provided by the project maintainers in a recent advisory, “Schema interpretation in the Java SDK of Apache Avro 1.11.3 and earlier versions permits malicious actors to implement any code of their choice.” They advised users to update to either version 1.11.4 or 1.12.0 as both address this particular issue.

Similar to Google’s Protocol Buffers (protobuf), Apache Avro is an open-source initiative that offers a language-independent data serialization framework for large-scale data processing.

The Avro development team has highlighted that the security loophole impacts any program that allows users to supply their own Avro schemas for processing. The detection and disclosure of this security flaw are credited to Kostya Kortchinsky from the Databricks security team.

To address this issue, it is advised to filter and review schemas before utilizing them and to avoid employing schemas provided by users for processing.

Mayuresh Dani, Manager of threat research at Qualys, elaborated on the vulnerability stating, “CVE-2024-47561 impacts Apache Avro 1.11.3 and earlier versions while handling input received through avroAvro design,” in a briefing sent to The Hacker News.

“The handling of such input from potential attackers results in the execution of code. Although no proof of concept is known to be publicly available based on our intelligence reports, this vulnerability exists in processing packets via ReflectData and SpecificData directives and is also exploitable through Kafka.”

“Given that Apache Avro is broadly used by numerous entities due to being an open-source project, this poses significant security risks, particularly when left unaddressed, unattended, and unprotected, as indicated by publicly accessible data, with the bulk of these entities situated in the United States.”

Discovered this article intriguing? Don’t forget to track our Twitter and LinkedIn profiles for more of our exclusive content.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts