Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11

Vulnerability

Overview Apache Geode versions prior to 1.15.0 contain a deserialization of untrusted data flaw when the REST API is used on Java 8 or Java 11 [1]. This vulnerability arises because the REST endpoint deserializes user-supplied data without adequate validation, allowing an attacker to craft malicious serialized objects that are then processed by the server.

Exploitation

Prerequisites An attacker must have network access to the Geode REST API endpoint and be able to send serialized Java objects. No authentication is mentioned as a prerequisite, meaning unauthenticated remote attackers may exploit this flaw. The vulnerability is present only when running on Java 8 or Java 11.

Impact

Successful exploitation could allow an attacker to execute arbitrary code in the context of the Geode process, leading to full system compromise, data exfiltration, or service disruption.

Mitigation

Users should upgrade to Apache Geode 1.15.0 or later and follow the documentation to enable the 'validate-serializable-objects=true' setting and specify allowed serializable classes via 'serializable-object-filter' [1]. Note that enabling validation may impact performance.