CVE-2023-45859

Overview

Hazelcast is an open-source, in-memory computing platform for Java and other languages that provides distributed data structures, caching, messaging, and stream/compute processing across a cluster of nodes. Client applications connect to a Hazelcast cluster over its client protocol to read and write distributed data and to invoke server-side operations.

An authorization bypass vulnerability (CVE-2023-45859) has been identified in the Hazelcast client protocol, which allows an authenticated client to invoke sensitive cluster operations without holding the permissions those operations require. As a result, a client can read or manipulate distributed data that lies outside its granted authorization scope.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Hazelcast.

‍

Details

Module Info

• Product: Hazelcast Platform
• Affected packages: com.hazelcast:hazelcast
• Affected versions: <=5.1.7, >=5.2.0 <5.2.5, >=5.3.0 <5.3.5
• GitHub repository: https://github.com/hazelcast/hazelcast
• Published packages: https://central.sonatype.com/artifact/com.hazelcast/hazelcast
• Package manager: Maven
• Fixed in: NES for Hazelcast 5.1.7-hazelcast-5.1.9

Vulnerability Info

This High-severity vulnerability is found in the com.hazelcast:hazelcast package.

Hazelcast clients communicate with a cluster member over the client protocol. Each incoming request is dispatched to a server-side handler, a MessageTask, which the member runs on behalf of the authenticated client. Before a task executes, Hazelcast's security layer calls the task's getRequiredPermission() method and checks the client's subject against the returned Permission. Numerous message tasks that expose sensitive operations declared that no permission was required by returning null:

public Permission getRequiredPermission() {
    return null;
}

Because the required permission is null, the permission subsystem performs no authorization check for that operation. On a cluster that has client security enabled, any authenticated client, regardless of the permissions granted to its subject, can therefore invoke the affected tasks and reach data it should not be able to access. The gap spans a wide range of operations, including fetching and iterating map keys and entries, reading and iterating cache configuration and contents, querying CP semaphore metadata, running SQL mapping DDL, and creating distributed-object proxies. The proxy-creation handler, CreateProxiesMessageTask, is representative: it neither declared a required permission nor performed a per-object permission check, so a client could create proxies for objects outside its authorization scope.

This vulnerability has been present since the first release of Hazelcast.

‍

Mitigation

Only recent versions of Hazelcast are community-supported. The affected 5.1.x line is End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade Hazelcast to a currently supported release that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• No public finder credit is listed in the advisory sources checked for this entry.