CVE-2023-38647
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader, allowing it to load a JAR from a specified URL. This unbounded deserialization can lead to remote code execution.
Risk Assessment
The organization is at risk of remote code execution, which could lead to serious security breaches and data loss.
Recommendation
It is recommended to temporarily stop using YAML-based configuration and workflow creation. In the long term, all Helix versions should be upgraded to 1.3.0.
Original NVD description (English source)
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation. Affect all the versions lower and include 1.2.0. Affected products: helix-core, helix-rest Mitigation: Short term, stop using any YAML based configuration and workflow creation. Long term, all Helix version bumping up to 1.3.0