CVE-2017-15693

Vulnerability

In Apache Geode versions before v1.4.0, the server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized without proper validation. This insecure deserialization flaw exists because Geode did not restrict which classes could be deserialized via Java's ObjectInputStream [1]. The fix introduced in v1.4.0 adds two new properties: serializable-object-filter and validate-serializable-objects to enforce a whitelist/blacklist for serialized objects [2][3].

Exploitation

An attacker must have DATA:WRITE access to the Geode cluster. With that privilege, the attacker can craft a malicious serialized Java object containing a class that performs arbitrary actions during deserialization. When the Geode server performs cluster operations or specific API invocations that trigger deserialization of stored objects, the malicious payload is deserialized [1]. The exploit requires that certain gadget classes (classes that execute commands during deserialization) are present on the Geode server's classpath [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the Geode server. This results in full remote code execution (RCE) with the privileges of the Geode process, leading to complete compromise of confidentiality, integrity, and availability of the server and its data [1].

Mitigation

The vulnerability is fixed in Apache Geode v1.4.0, released on 2017-12-15 [2][3]. Users should upgrade to v1.4.0 or later. For versions prior to the fix, administrators should configure the newly introduced serializable-object-filter and validate-serializable-objects properties to restrict deserialization to a known set of safe classes [3]. There is no workaround for older versions that do not support these properties.