Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows attackers to bypass the security mechanisms of InLong JDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747
The vulnerability stems from improper handling of data deserialization in the InLong JDBC component. An attacker sends crafted malicious data that is deserialized by the application without proper validation of its origin and content. The deserialization mechanism processes input data in a way that allows bypassing built-in JDBC security. As a result, it is possible to force the server to read arbitrary files from the file system.
An attacker can gain unauthorized access to arbitrary files on the server and compromise system integrity by bypassing Apache InLong JDBC security mechanisms — all without authentication and user interaction.
Apache InLong must be updated immediately to version 2.2.0. Alternatively, you can apply the cherry-pick fix available in the pull request: https://github.com/apache/inlong/pull/11747
Apache InLong in versions 1.13.0 to 2.1.0 inclusive
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NApache Inlong
APPApache1.13.0 – 2.2.0 (excl.)
Related vulnerabilities
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache I...
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache I...
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache I...
Apache InLong: deserializacja danych — odczyt dowolnych plików
Apache InLong — Code Injection umożliwiający zdalne wykonanie kodu (RCE)