Description

CVE-2024-56518 describes a remote code execution vulnerability in Hazelcast Management Center versions up to 6.0. It arises from the ability to upload a malicious hazelcast-client XML document containing a JndiLoginModule with a crafted user.provider.url at the /cluster-connections URI. This allows unauthenticated attackers to execute arbitrary code on the server. While the CVSS score is 0, SOCRadar's Vulnerability Risk Score (SVRS) is 30, indicating the vulnerability's inherent risk and potential for exploitation should a working exploit become publicly available.

Key Insights

• Remote Code Execution: The vulnerability allows for unauthenticated remote code execution, representing a critical threat as attackers can gain complete control over the affected system.
• Configuration File Injection: The attack vector involves uploading a malicious configuration file, making it harder to detect via standard network intrusion detection systems that primarily monitor network traffic.
• Potential for Lateral Movement: Compromised Hazelcast Management Centers can be used as a pivot point to gain access to other systems and data within the network due to its role in managing Hazelcast clusters.

Mitigation Strategies

• Upgrade to a patched version: Upgrade Hazelcast Management Center to a version above 6.0 where this vulnerability is patched.
• Implement Strict Input Validation: If upgrading is not immediately possible, implement strict input validation on all uploaded files, specifically for XML documents targeting Hazelcast Management Center. Validate against a defined schema and disallow external references.
• Network Segmentation: Isolate the Hazelcast Management Center within a segmented network, limiting its access to critical resources and reducing the potential blast radius in case of a successful attack.
• Web Application Firewall (WAF) Rules: Deploy and configure a WAF with rules to detect and block attempts to upload configuration files containing malicious JNDI configurations or other suspicious content.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.