CVE-2023-45860

Overview

Hazelcast is an open-source, in-memory computing platform for Java and other languages that provides distributed data structures, caching, messaging, and stream/compute processing across a cluster of nodes. Client applications connect to a Hazelcast cluster over its client protocol to read and write distributed data and to invoke server-side operations.

An authorization bypass vulnerability (CVE-2023-45860) has been identified in the Hazelcast SQL file connector (the "CSV File Source" connector), which allows a low-privileged authenticated client to read data from arbitrary files on a cluster member's filesystem. By issuing a CREATE MAPPING statement for the file connector, a client that holds no file-read permission causes the member to open and sample an attacker-chosen path during field resolution and to build an unsecured job that reads the file's contents, bypassing the connector permission model.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Hazelcast, including the End-of-Life 5.1.x line.

‍

Details

Module Info

• Product: Hazelcast Platform
• Affected packages: com.hazelcast:hazelcast
• Affected versions: >=5.0 <=5.1.7, >=5.2.0 <5.2.5, >=5.3.0 <5.3.5
• GitHub repository: https://github.com/hazelcast/hazelcast
• Published packages: https://central.sonatype.com/artifact/com.hazelcast/hazelcast
• Package manager: Maven
• Fixed in: NES for Hazelcast 5.1.7-hazelcast-5.1.9

Vulnerability Info

This High-severity vulnerability is found in the com.hazelcast:hazelcast package, in the SQL layer that resolves and stores file mappings. Hazelcast SQL lets a client define an external table with CREATE MAPPING; for the file connector this mapping points at a path on a cluster member. Creating the mapping first resolves the mapping's field names, and for the file connector that resolution reads a sample of the target file directly from the member's filesystem. On the affected line this path performed no authorization check, so a client that could submit CREATE MAPPING but held no file-read permission could still cause the member to read a file of the attacker's choosing.

In the SQL schema layer, mapping creation resolved and persisted the mapping without consulting the caller's permissions:

public void createMapping(Mapping mapping, boolean replace, boolean ifNotExists) {
    Mapping resolved = resolveMapping(mapping);
    // resolveMapping reads a sample of the external resource (for the file
    // connector, a file on the member's filesystem) to resolve field names,
    // then stores the mapping. No permission is required or checked.
}

The file connector never declared the permissions its field resolution needs, and the underlying file-reading processor was published through an unsecured supplier that let the engine construct an unsecured processing job:

// ReadFilesP file source: an unsecured processor supplier
return ProcessorSupplier.of(() -> new ReadFilesP<>(...));

Because neither the mapping-resolution path nor the file-reading job enforced the ConnectorPermission.file(path, READ) permission, a client with only the ability to run SQL could read arbitrary files from a member, exposing their contents through the mapping. The advisory labels this issue CWE-89 (SQL injection), but the underlying defect is a missing authorization check on the file connector, not injection of SQL syntax. Exploitation requires an authenticated client that can submit SQL against a member with the Jet engine enabled, which is the default.

This vulnerability was introduced in 2021 with Hazelcast 5.0.

‍

Mitigation

Only recent versions of Hazelcast are community-supported. The affected 5.1.x line is End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade Hazelcast to a currently supported release that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• No public finder credit is listed in the advisory sources checked for this entry.