Apache InLong: JDBC URL bypassing by adding blanks

Vulnerability

Description

CVE-2023-31058 is a deserialization of untrusted data vulnerability in Apache InLong versions 1.4.0 through 1.6.0 [1]. The root cause is that the 'autoDeserialize' option filter can be bypassed by inserting blanks into the serialized data, allowing an attacker to inject malicious objects that will be deserialized by the application [1]. This affects the core functionality of Apache InLong, a one-stop integration framework for massive data [2].

Exploitation

An attacker can exploit this vulnerability by crafting a serialized payload that includes blanks to evade the filtering mechanism [1]. This payload can be delivered via JDBC URL or other data inputs that are deserialized by the Manager module. No authentication is required for exploitation, as the vulnerability can be triggered by simply sending a specially crafted request to the affected service [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the server, potentially leading to full system compromise. This includes unauthorized access to sensitive data, disruption of services, and lateral movement within the network [1].

Mitigation

The issue has been fixed in Apache InLong version 1.7.0 [1]. Users are advised to upgrade to this version or apply the patch from pull request #7674 [3], which removes whitespace from the URL before validation [3]. There are no known workarounds for this vulnerability [1].