CVE-2017-15696

Vulnerability

Apache Geode clusters running in secure mode before version 1.4.0 are vulnerable because the configuration service does not properly authorize configuration requests [2]. An unprivileged user who gains access to a Geode locator can exploit this to retrieve sensitive data.

Exploitation

An attacker must have network access to the Geode locator. No authentication is required beyond access to the locator port. The attacker sends unauthenticated configuration requests to the locator, which does not verify authorization in secure mode.

Impact

Successful exploitation allows an attacker to extract cluster configuration data and previously deployed application code, leading to information disclosure of potentially sensitive configurations and code.

Mitigation

The vulnerability is fixed in Apache Geode version 1.4.0 [3]. Users should upgrade to 1.4.0 or later. No workarounds are documented; running in non-secure mode may avoid the issue but is not recommended for security.