CVE-2017-12622

Vulnerability

When an Apache Geode cluster is running in secure mode (versions before 1.3.0), an authenticated user who connects to the cluster using the gfsh tool over HTTP can bypass authorization checks. The vulnerability, tracked as GEODE-3685 [2], results in MBean wrappers not being applied correctly, allowing the user to perform operations that should require the CLUSTER:MANAGE privilege [1]. Specifically, the user can obtain cluster-wide status information and control cluster members without having the proper authorization [1].

Exploitation

An attacker must have a valid authenticated session to the Apache Geode cluster via the HTTP interface used by gfsh. No additional network position beyond connectivity to the cluster is required, as the attack leverages the normal authenticated gfsh session [1]. The flaw lies in the failure to correctly enforce authorization on MBean operations; the attacker simply uses the standard gfsh commands that query status or issue control directives, and the cluster incorrectly permits these actions [2].

Impact

Successful exploitation allows an authenticated attacker to read sensitive cluster status information (information disclosure) and perform control operations on cluster members (loss of integrity/availability). The attacker gains unauthorized administrative-level capabilities, such as changing configurations or influencing cluster behavior, even though they lack the CLUSTER:MANAGE privilege [1].

Mitigation

The fix is included in Apache Geode version 1.3.0 and later [1]. Users operating an earlier version in secure mode should upgrade to at least 1.3.0 to remediate the issue. No workarounds are disclosed in available references. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.