CVE-2022-36437

Vulnerability

Overview

The Connection handler in Hazelcast and Hazelcast Jet contains a flaw that allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection [1][3]. This issue stems from improper handling of connection identities, enabling session hijacking without prior authentication.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted network requests to a vulnerable Hazelcast or Hazelcast Jet cluster. No authentication is required, and the attack is remotely exploitable over the network [1]. While enabling TLS with mutual authentication significantly lowers the risk, it does not fully eliminate the vulnerability [3].

Impact

Successful exploitation grants the attacker the same privileges as an authenticated user, allowing unauthorized access to cluster data and the ability to manipulate that data [1][3]. This could lead to data breaches, data corruption, or further compromise of the cluster and connected systems.

Mitigation

Hazelcast has released patches for the affected versions: Hazelcast Jet 4.5.4, Hazelcast IMDG 3.12.13, 4.1.10, 4.2.6, and Hazelcast Platform 5.1.3 [3]. There is no known workaround, but deploying TLS with mutual authentication reduces the attack surface [3]. Users are strongly advised to upgrade to the patched versions.