CVE-2024-52577: Apache Ignite: Possible RCE when deserializing incoming messages by the server node
First published: Fri Feb 14 2025(Updated: )
In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Ignite | >=2.6.0<2.17.0 | |
| maven/org.apache.ignite:ignite-core | >=2.6.0<2.17.0 | 2.17.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread/1bst0n27m9kb3b6f6hvlghn182vqb2hh
- http://www.openwall.com/lists/oss-security/2025/02/14/2
- https://nvd.nist.gov/vuln/detail/CVE-2024-52577
- https://github.com/apache/ignite/commit/f1d3579eabb2c6f5b11b94d58600afc497a8603d
- https://github.com/advisories/GHSA-8355-xj3p-hv6q (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-52577?
CVE-2024-52577 is considered to be a high-severity vulnerability due to its potential for exploitation through crafted Ignite messages.
How do I fix CVE-2024-52577?
To fix CVE-2024-52577, upgrade Apache Ignite to a version later than 2.17.0.
What versions of Apache Ignite are affected by CVE-2024-52577?
CVE-2024-52577 affects Apache Ignite versions from 2.6.0 up to, but not including, 2.17.0.
What kind of attacks can be performed using CVE-2024-52577?
An attacker can exploit CVE-2024-52577 by crafting Ignite messages that include vulnerable objects, potentially leading to remote code execution.
Are there any mitigations for CVE-2024-52577?
Currently, the best mitigation for CVE-2024-52577 is to update to a non-vulnerable version of Apache Ignite.
- agent/title
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-52577
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/references
- agent/source
- agent/softwarecombine
- agent/event
- agent/trending
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-8355-xj3p-hv6q
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-cve
- agent/tags
- collector/github-advisory
- vendor/apache
- canonical/apache ignite
- package-manager/maven