CVE-2017-9795

Vulnerability

In Apache Geode clusters running in secure mode before version 1.3.0, the Object Query Language (OQL) execution engine does not properly enforce region-level authorization. A user granted read access to specific regions can craft OQL queries that read or write objects in unauthorized regions. Additionally, the flawed OQL processing can allow method invocation that leads to remote code execution [1]. The issue is tracked as GEODE-3247 [2].

Exploitation

An attacker must have valid credentials for an Apache Geode cluster operating in secure mode and must possess at least read access to one or more regions. Using that access, the attacker sends specially crafted OQL queries that bypass region authorization checks. The queries can both access data outside the user’s intended scope and, due to insecure method invocation during query evaluation, execute arbitrary code on the server [1][2].

Impact

A successful exploit permits an authenticated attacker to read and write data in unauthorized regions, violating confidentiality and integrity. More critically, the same attack vector can yield full remote code execution (RCE) on the Geode server, giving the attacker the ability to run arbitrary commands with the privileges of the Geode process [1].

Mitigation

Upgrade to Apache Geode 1.3.0 or later, which includes the fix for OQL authorization enforcement and method invocation restrictions [2]. No workaround is available for earlier versions. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog as of the publication date.