Apache inlong has an Arbitrary File Read Vulnerability

Root

Cause

CVE-2023-46227 is a Deserialization of Untrusted Data vulnerability in Apache InLong, a one-stop integration framework for massive data [3]. The flaw exists in the component that handles MySQL JDBC URLs. By injecting a tab character (\t) into the URL, an attacker can bypass the input validation or filtering that was intended to block malicious serialized data, leading to unsafe deserialization [1].

Attack

Vector and Exploitation The vulnerability affects Apache InLong versions 1.4.0 through 1.8.0. An attacker requires network access to the InLong Manager service endpoint that processes JDBC connection strings. No prior authentication is mentioned as a prerequisite, making the attack surface relatively wide. The exploitation leverages the tab character to escape the intended sanitization checks, enabling the delivery of a crafted serialized payload [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code or perform other malicious actions on the server, depending on the deserialized object's capabilities. This can lead to full compromise of the InLong instance, including data exfiltration, service disruption, or lateral movement within the environment.

Mitigation

The Apache InLong project has released version 1.9.0, which contains the fix [1]. Users unable to upgrade immediately can apply the cherry-pick commit from pull request #8814 [1]. No workaround other than patching is provided. It is recommended to upgrade as soon as possible.