CVE-2023-5384

Overview

Infinispan is an open-source in-memory data grid and distributed key/value data store. Java applications embed it as a local or clustered cache through infinispan-core, or connect to a cluster of Infinispan Server nodes through the Java Hot Rod client, infinispan-client-hotrod. Its modules are published to Maven Central under org.infinispan, and Spring Boot 2.7 manages the Infinispan 13.0 BOM.

An information exposure vulnerability (CVE-2023-5384) has been identified in Infinispan's cache configuration serialization, which allows attackers who can read a serialized cache configuration to obtain the database and remote-store credentials it contains. When a cache configuration with a JDBC store connection or a remote store is written out as XML, JSON or YAML, the credentials are returned in clear text.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Infinispan.

Details

Module Info

• Product: Infinispan
• Affected packages: org.infinispan:infinispan-core, org.infinispan:infinispan-commons, org.infinispan:infinispan-hotrod, org.infinispan:infinispan-client-hotrod, org.infinispan:infinispan-cachestore-jdbc-common, org.infinispan:infinispan-cachestore-remote, org.infinispan:infinispan-cachestore-sql, org.infinispan:infinispan-cachestore-jdbc
• Affected versions: <14.0.25.Final, >=15.0.0.Dev01 <15.0.0.Dev07
• GitHub repository: https://github.com/infinispan/infinispan
• Published packages: https://central.sonatype.com/artifact/org.infinispan/infinispan-core, https://central.sonatype.com/artifact/org.infinispan/infinispan-commons, https://central.sonatype.com/artifact/org.infinispan/infinispan-hotrod, https://central.sonatype.com/artifact/org.infinispan/infinispan-client-hotrod, https://central.sonatype.com/artifact/org.infinispan/infinispan-cachestore-jdbc-common, https://central.sonatype.com/artifact/org.infinispan/infinispan-cachestore-remote, https://central.sonatype.com/artifact/org.infinispan/infinispan-cachestore-sql, https://central.sonatype.com/artifact/org.infinispan/infinispan-cachestore-jdbc
• Package manager: Maven
• Fixed in:
  • OSS Infinispan 14.0.25.Final, 15.0.0.Dev07
  • NES for Infinispan 13.0.24 (13.0.22-infinispan-13.0.24)

Vulnerability Info

This Medium-severity vulnerability is found in the org.infinispan:infinispan-cachestore-jdbc-common package, and in the related store, client and core packages listed above, in multiple versions of Infinispan. Infinispan masks secret values only for configuration attributes that use its secret serializer, and only when the configuration writer is not asked for clear-text secrets. The credentials of the JDBC and remote cache stores bypass that protection.

For JDBC stores, the connection factory declares its user name and password as plain string attributes, and the store serializer writes them out unconditionally for both simple connections and connection pools:

public static final AttributeDefinition<String> USERNAME = AttributeDefinition.builder(org.infinispan.persistence.jdbc.common.configuration.Attribute.USERNAME, null, String.class).immutable().build();
public static final AttributeDefinition<String> PASSWORD = AttributeDefinition.builder(org.infinispan.persistence.jdbc.common.configuration.Attribute.PASSWORD, null, String.class).immutable().build();

private void writeJDBCStoreConnection(ConfigurationWriter writer, PooledConnectionFactoryConfiguration configuration) {
   writer.writeStartElement(Element.CONNECTION_POOL);
   writeOptional(writer, Attribute.CONNECTION_URL, configuration.connectionUrl());
   writeOptional(writer, Attribute.DRIVER_CLASS, configuration.driverClass());
   writeOptional(writer, Attribute.USERNAME, configuration.username());
   writeOptional(writer, Attribute.PASSWORD, configuration.password());
   writer.writeEndElement();
}

The remote store has the same gap. Its SASL MechanismConfiguration user name and password and the key store and trust store passwords of its SSL configuration are plain string attributes with no secret serializer, and its Hot Rod URI is written as given. HotRodURI.toString() in infinispan-client-hotrod also prints the password:

@Override
public String toString() {
   return "HotRodURI{" +
         "addresses=" + addresses +
         ", ssl=" + ssl +
         ", username='" + username + '\'' +
         ", password='" + password + '\'' +
         ", properties=" + properties +
         '}';
}

As a result, any code path that serializes a cache configuration returns these credentials in clear text, even when it builds the writer without clear-text secrets. In Infinispan Server, the REST API's cache config action serializes the running cache configuration this way, so a user who can read cache configurations, and who need not hold the database or remote cluster credentials, can recover them. An embedded application that never writes its cache configuration out does not expose the credentials this way.

Mitigation

Infinispan's security policy lists only its current release lines as supported for vulnerability updates, and upstream has made no 13.0.x release since 13.0.22.Final (April 2024), so no 13.0.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Infinispan that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.