CVE-2024-54676

The default clustering documentation for Apache OpenMeetings does not specify the configuration of allowed and forbidden class lists (whitelist/blacklist) for the OpenJPA library. As a result, the runtime environment can deserialize data from untrusted sources without proper class type verification. An attacker can send a crafted payload containing a malicious serialized Java object, which will be deserialized by the application, potentially leading to arbitrary code execution.

An unauthenticated remote attacker can gain full control over the system — achieving confidentiality, integrity, and availability at a critical level, which in practice means the ability to execute arbitrary code (RCE) on the server.

Apache OpenMeetings should be updated to version 8.0.0. Additionally, the application startup scripts must be updated with the parameters 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' according to the updated clustering documentation available at https://openmeetings.apache.org/Clustering.html.

Apache OpenMeetings in versions from 2.1.0 to 7.x (before version 8.0.0), particularly instances running in a cluster configuration consistent with the vendor's default documentation.