Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization

CVE-2024-43441 is a critical (CVSS 9.8) authentication-bypass flaw (CWE-302, Authentication Bypass by Assumed-Immutable Data) in Apache HugeGraph-Server, where the server validates access based on request data it assumes cannot be modified. A remote attacker with network access can send specially crafted requests that tamper with this assumed-immutable data (such as credential/token material supplied in the request), slipping past the authentication layer of the server's API without any valid credentials. The flaw requires no privileges and no user interaction, and once past authentication the attacker gains the access of a legitimate user, with high impact on confidentiality, integrity, and availability of the graph data (CVSS C:H/I:H/A:H). All HugeGraph-Server deployments running version 1.0.0 or later but earlier than 1.5.0 are affected; the flaw is most consequential where authentication was deliberately enabled, since it renders that protection ineffective. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the EPSS score of 69.4% (99th percentile) indicates a high likelihood of exploitation within 30 days, so this should be treated as urgent to patch.

Do: Upgrade Apache HugeGraph-Server to version 1.5.0, which fixes the issue. Until patched, do not rely on authentication to protect exposed instances: locate any HugeGraph-Server reachable from untrusted networks (REST/Gremlin API, by default on port 8080) and restrict access with firewall rules or a reverse proxy. Given the 69.4% EPSS score, review server logs for unexpected unauthenticated API access and watch for follow-on PoC or exploitation reports.

CVE-2024-45387 is an SQL injection flaw in Traffic Ops, the API component of the Apache Traffic Control CDN management platform, affecting version 8.0.0 per the Apache advisory. It is triggered when a user who already holds one of the "admin", "federation", "operations", "portal", or "steering" roles sends a specially crafted PUT request to the Traffic Ops API. Successful injection lets the attacker execute arbitrary SQL against the Traffic Ops database, allowing them to read, modify, or corrupt stored data, consistent with the high confidentiality, integrity, and availability ratings in the 8.8 CVSS score. Any operator running an affected Traffic Ops deployment is exposed, though exploitation requires an authenticated privileged account. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS places this flaw in the 99th percentile with roughly a 41.5% probability of exploitation within 30 days, so patching is urgent.

Do: Upgrade Traffic Ops to Apache Traffic Control 8.0.2 or later as recommended by the advisory. In the meantime, restrict API access to trusted networks and review accounts holding the admin, federation, operations, portal, and steering roles, since any of them can trigger the injection via crafted PUT requests. Check Traffic Ops and database logs for unexpected or anomalous SQL from API activity, and watch for public exploits given the elevated EPSS score.

Apache MINA's ObjectSerializationDecoder processes incoming data using Java's native deserialization protocol without the necessary security checks or defenses (CWE-502), and the flaw carries a maximum CVSS 4.0 score of 10.0. An attacker who can send data to a service using this decoder can deliver a specially crafted serialized object that is reconstructed without validation, leading to remote code execution with no privileges, user interaction, or attack prerequisites required. Exploitation is conditional: only applications that call IoBuffer#getObject(), typically when a ProtocolCodecFilter built with ObjectSerializationCodecFactory is added to the filter chain, are affected, and the FtpServer, SSHd, and Vysper sub-projects are explicitly not impacted. All MINA core 2.0.X, 2.1.X, and 2.2.X releases prior to 2.0.27, 2.1.10, and 2.2.4 respectively are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA's KEV, but EPSS assigns a 23.9% probability of exploitation within 30 days (98th percentile), indicating elevated risk.

Do: Upgrade MINA core to 2.0.27, 2.1.10, or 2.2.4 depending on which 2.x line you run. After upgrading, explicitly allow the classes your protocol needs on the ObjectSerializationDecoder using the new accept(ClassNameMatcher), accept(Pattern), or accept(String...) methods, since the default now rejects all incoming classes. Audit your filter chain for ObjectSerializationCodecFactory usage or any IoBuffer#getObject() call to confirm whether you are exposed; FtpServer, SSHd, and Vysper deployments are not affected.

Apache Struts contains a flaw in its legacy file upload logic (CWE-434) that allows an attacker to manipulate file upload parameters to traverse paths outside the intended upload directory. It is triggered when an application relies on the old upload mechanism built around FileuploadInterceptor; applications using the new file upload mechanism are not affected. By uploading a malicious file to a location where it can be executed, an attacker can, under some circumstances, achieve remote code execution on the server. All Apache Struts versions from 2.0.0 up to but not including 6.4.0 are affected, though only deployments still using the legacy upload interceptor. There is no public PoC or CISA KEV entry yet, but EPSS is exceptionally high (78.2%, 100th percentile) and news reports indicate threat actors are already attempting to exploit the flaw in the wild.

Do: Upgrade Apache Struts to version 6.4.0 or later and migrate applications to the new file upload mechanism. If upgrading is not immediately possible, verify whether your application uses the legacy FileuploadInterceptor; if it does not, the application is safe. Review upload parameter handling and monitor the official S2-067 advisory for mitigation details, as active exploitation attempts have been reported.

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.