CRITICAL🇵🇱 Wersja polska

CVE-2024-52577

CVSS 9.5v4.0pub. 2025-02-14upd. 2025-07-14

In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The attacker manually constructs a crafted Ignite protocol message containing an object of a vulnerable class that is available in the server's classpath. Despite configured deserialization filters, the Ignite server does not apply them for selected endpoints, thus processing the malicious object without verification. Deserialization of such a message by the Ignite server leads to arbitrary code execution on the server side.

Impact

An attacker can remotely execute arbitrary code on the Apache Ignite server, which may result in complete takeover of the server and associated systems.

Mitigation & patch

Apache Ignite should be updated to version 2.17.0 or later, where the vulnerability has been fixed. If immediate update is not possible, it is recommended to restrict network access to Ignite server endpoints exclusively to trusted hosts using a firewall.

Who is affected

Apache Ignite versions 2.6.0 to 2.16.x (before 2.17.0)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X