CVE-2023-28754: ShardingSphere-Agent: Deserialization vulnerability in ShardingSphere Agent
First published: Wed Jul 19 2023(Updated: )
Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML configuration file. The attacker needs to have permission to modify the ShardingSphere Agent YAML configuration file on the target machine, and the target machine can access the URL with the arbitrary code JAR. An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. When the ShardingSphere JVM process starts and uses the ShardingSphere-Agent, the arbitrary code specified by the attacker will be executed during the deserialization of the YAML configuration file by the Agent. This issue affects ShardingSphere-Agent: through 5.3.2. This vulnerability is fixed in Apache ShardingSphere 5.4.0.
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.shardingsphere:shardingsphere | <=5.3.2 | 5.4.0 |
| Apache ShardingSphere | <5.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-28754?
CVE-2023-28754 is a deserialization vulnerability in ShardingSphere Agent that allows attackers to execute arbitrary code by constructing a special YAML configuration file.
How does CVE-2023-28754 work?
CVE-2023-28754 works by exploiting the deserialization of untrusted data in the ShardingSphere Agent, allowing attackers to execute arbitrary code.
What is the severity of CVE-2023-28754?
CVE-2023-28754 has a severity of 8.8 (high).
Which software are affected by CVE-2023-28754?
ShardingSphere Agent versions up to and including 5.3.2, as well as Apache ShardingSphere versions up to but not including 5.4.0, are affected by CVE-2023-28754.
How can CVE-2023-28754 be mitigated?
To mitigate CVE-2023-28754, update ShardingSphere Agent to version 5.4.0 or higher.
- collector/oss-sec
- alias/CVE-2023-28754
- collector/nvd-latest
- collector/github-advisory
- alias/GHSA-3cxh-xp3g-jxjm
- collector/github-advisory-latest
- collector/nvd-index
- collector/nvd-cve
- agent/type
- agent/references
- agent/author
- agent/severity
- agent/title
- agent/weakness
- agent/softwarecombine
- agent/description
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/trending
- agent/tags
- agent/source
- package-manager/maven
- vendor/apache
- canonical/apache shardingsphere