CVE-2023-4586

Overview

Infinispan is an open-source in-memory data grid and distributed key/value data store. Java applications embed it as a local or clustered cache through infinispan-core, or connect to a cluster of Infinispan Server nodes through the Java Hot Rod client, infinispan-client-hotrod. Its modules are published to Maven Central under org.infinispan, and Spring Boot 2.7 manages the Infinispan 13.0 BOM.

An information exposure vulnerability (CVE-2023-4586) has been identified in the Infinispan Hot Rod Java client, which allows attackers in a man-in-the-middle position to intercept and alter the traffic of a client that connects over TLS. The client does not check that the server's certificate was issued for the host it is connecting to, so any certificate the client's truststore accepts is accepted for every server. The remote cache store, infinispan-cachestore-remote, connects to its remote cluster through the same client and is exposed in the same way.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Infinispan.

Details

Module Info

• Product: Infinispan
• Affected packages: org.infinispan:infinispan-client-hotrod, org.infinispan:infinispan-cachestore-remote
• Affected versions:
  • org.infinispan:infinispan-client-hotrod: <14.0.18.Final
  • org.infinispan:infinispan-cachestore-remote: <14.0.18.Final
• GitHub repository: https://github.com/infinispan/infinispan
• Published packages: https://central.sonatype.com/artifact/org.infinispan/infinispan-client-hotrod, https://central.sonatype.com/artifact/org.infinispan/infinispan-cachestore-remote
• Package manager: Maven
• Fixed in:
  • OSS Infinispan 14.0.18.Final
  • NES for Infinispan v13.0.24

Vulnerability Info

This High-severity vulnerability is found in the org.infinispan:infinispan-client-hotrod package in multiple versions of Infinispan. When TLS is enabled, the Hot Rod client's ChannelInitializer.initSsl builds a Netty SslHandler for each connection. It sets the TLS SNI server name only when one is configured and never sets an endpoint identification algorithm on the SSLEngine:

SslHandler sslHandler = sslContext.newHandler(channel.alloc(), ssl.sniHostName(), -1);
if (ssl.sniHostName() != null) {
   SSLParameters sslParameters = sslHandler.engine().getSSLParameters();
   sslParameters.setServerNames(Collections.singletonList(new SNIHostName(ssl.sniHostName())));
   sslHandler.engine().setSSLParameters(sslParameters);
}
channel.pipeline().addFirst(sslHandler,
      SslHandshakeExceptionHandler.INSTANCE);

Without an endpoint identification algorithm such as HTTPS, the JDK SSLEngine checks only that the server's certificate chains to a certificate in the client's truststore. It does not compare the certificate's subject or subjectAltName with the host the client is connecting to. An attacker who can intercept the network path between the client and the Infinispan Server, and who holds any certificate the truststore trusts (for example one issued by the same internal or public certificate authority for a different host), can complete the TLS handshake in place of the server. The attacker can then read and modify the Hot Rod traffic, including cache keys and values and the credentials the client sends during authentication. The org.infinispan:infinispan-cachestore-remote package builds its connection to the remote cluster from its SSL settings through this client, so a remote cache store that uses TLS accepts an impostor server in the same way.

Mitigation

Infinispan's security policy lists only its current release lines as supported for vulnerability updates, and upstream has made no 13.0.x release since 13.0.22.Final (April 2024), so no 13.0.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Infinispan that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.