CVE-2024-22399: Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server
First published: Wed Sep 11 2024(Updated: )
Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private protocol. This issue affects Apache Seata: 2.0.0, from 1.0.0 through 1.8.0. Users are recommended to upgrade to version 2.1.0/1.8.1, which fixes the issue.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.seata:seata-core | =2.0.0 | 2.1.0 |
| maven/org.apache.seata:seata-core | >=1.0.0<1.8.1 | 1.8.1 |
| Apache Seata Server | >=1.0.0<1.8.1 | |
| Apache Seata Server | =2.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-22399?
CVE-2024-22399 has been classified as a medium severity vulnerability due to the deserialization of untrusted data that can lead to arbitrary code execution.
How do I fix CVE-2024-22399?
To fix CVE-2024-22399, upgrade to Apache Seata version 1.8.1 or 2.1.0 or later, ensuring that authentication is enabled.
What causes CVE-2024-22399 in Apache Seata?
CVE-2024-22399 is caused by developers disabling authentication on the Seata-Server while not utilizing the Seata client SDK dependencies.
What are the affected versions for CVE-2024-22399?
CVE-2024-22399 affects Apache Seata versions 1.0.0 through 1.8.1 and version 2.0.0.
Is CVE-2024-22399 exploitable without authentication?
Yes, CVE-2024-22399 is exploitable when authentication is disabled, allowing for malicious serialized requests.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-22399
- agent/first-publish-date
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/references
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/event
- agent/softwarecombine
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-3xq2-w6j4-c99r
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/github-advisory
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/maven
- vendor/apache
- canonical/apache seata server
- version/apache seata server/1.0.0
- version/apache seata server/2.0.0