CVE-2023-38647: Deserialization vulnerability in Helix workflow and REST

July 26, 2023 (updated October 2, 2024)

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation.

Affect all the versions lower and include 1.2.0.

Affected products: helix-core, helix-rest

Mitigation: Short term, stop using any YAML based configuration and workflow creation. Long term, all Helix version bumping up to 1.3.0

References

github.com/advisories/GHSA-jhcr-hph9-g7wm
github.com/apache/helix/commit/09d210fa29b18f3b4de8d32f2369dc2b31f71f43
github.com/apache/helix/commit/eabfda26b18c72f4f945dcaac5756665c6a2cdac
lists.apache.org/thread/zyqxhv0lc2z9w3tgr8ttrdy2zfh5jvc4
nvd.nist.gov/vuln/detail/CVE-2023-38647

Detect and mitigate CVE-2023-38647 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →