CVE-2023-36480

The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.

The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.

GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-044

The GitHub Security Lab team has identified a potential security vulnerability in Aerospike Java Client.

We are committed to working with you to help resolve this issue. In this report you will find everything you need to effectively coordinate a resolution of this issue with the GHSL team.

If at any point you have concerns or questions about this process, please do not hesitate to reach out to us at [email protected] (please include GHSL-2023-044 as a reference).

If you are NOT the correct point of contact for this report, please let us know!

Summary

The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on.

Product

Aerospike Java Client

Tested Version

6.1.7

Details

Issue: Unsafe deserialization of server responses (GHSL-2023-044)

The Aerospike Java client implements different ways of communicating with an Aerospike server to perform several operations. Asynchronous commands can be executed using the Netty framework using the NettyCommand class. This class includes an InboundHandler that extends Netty's ChannelInboundHandlerAdapter, which handles inbound data coming from the Netty channel established with the server. This is implemented in the channelRead method:

client/src/com/aerospike/client/async/NettyCommand.java:1157

@Override
public void channelRead(ChannelHandlerContext ctx, Object msg) {
    command.read((ByteBuf)msg);
}

The incoming msg object is handled by the NettyCommand.read method, which behaves differently depending on the state variable. Several states produce paths to the vulnerable code — for instance, we will follow the path through AsyncCommand.COMMAND_READ_HEADER:

/client/src/com/aerospike/client/async/NettyCommand.java:489

private void read(ByteBuf byteBuffer) {
    eventReceived = true;

    try {
        switch (state) {
            // --snip--
            case AsyncCommand.COMMAND_READ_HEADER:
                if (command.isSingle) {
                    readSingleHeader(byteBuffer);
                }
                // --snip--
        }
        // --snip--
    }
    // --snip---
}

Some bytes are read from the message buffer and saved in command.dataBuffer in the readSingleHeader method, after which parseSingleBody is called:

client/src/com/aerospike/client/async/NettyCommand.java:596

private void readSingleHeader(ByteBuf byteBuffer) {
    int readableBytes = byteBuffer.readableBytes();
    int dataSize = command.dataOffset + readableBytes;

    // --snip--

    byteBuffer.readBytes(command.dataBuffer, 0, dataSize);
    command.dataOffset = dataSize;

    if (command.dataOffset >= receiveSize) {
        parseSingleBody();
    }
}

parseSingleBody simply delegates on…

The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.

The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.

GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-044

The GitHub Security Lab team has identified a potential security vulnerability in Aerospike Java Client.

We are committed to working with you to help resolve this issue. In this report you will find everything you need to effectively coordinate a resolution of this issue with the GHSL team.

If at any point you have concerns or questions about this process, please do not hesitate to reach out to us at [email protected] (please include GHSL-2023-044 as a reference).

If you are NOT the correct point of contact for this report, please let us know!

Summary

The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on.

Product

Aerospike Java Client

Tested Version

6.1.7

Details

Issue: Unsafe deserialization of server responses (GHSL-2023-044)

The Aerospike Java client implements different ways of communicating with an Aerospike server to perform several operations. Asynchronous commands can be executed using the Netty framework using the NettyCommand class. This class includes an InboundHandler that extends Netty's ChannelInboundHandlerAdapter, which handles inbound data coming from the Netty channel established with the server. This is implemented in the channelRead method:

client/src/com/aerospike/client/async/NettyCommand.java:1157

@Override
public void channelRead(ChannelHandlerContext ctx, Object msg) {
    command.read((ByteBuf)msg);
}

The incoming msg object is handled by the NettyCommand.read method, which behaves differently depending on the state variable. Several states produce paths to the vulnerable code — for instance, we will follow the path through AsyncCommand.COMMAND_READ_HEADER:

/client/src/com/aerospike/client/async/NettyCommand.java:489

private void read(ByteBuf byteBuffer) {
    eventReceived = true;

    try {
        switch (state) {
            // --snip--
            case AsyncCommand.COMMAND_READ_HEADER:
                if (command.isSingle) {
                    readSingleHeader(byteBuffer);
                }
                // --snip--
        }
        // --snip--
    }
    // --snip---
}

Some bytes are read from the message buffer and saved in command.dataBuffer in the readSingleHeader method, after which parseSingleBody is called:

client/src/com/aerospike/client/async/NettyCommand.java:596

private void readSingleHeader(ByteBuf byteBuffer) {
    int readableBytes = byteBuffer.readableBytes();
    int dataSize = command.dataOffset + readableBytes;

    // --snip--

    byteBuffer.readBytes(command.dataBuffer, 0, dataSize);
    command.dataOffset = dataSize;

    if (command.dataOffset >= receiveSize) {
        parseSingleBody();
    }
}

parseSingleBody simply delegates on…