Deserialization vulnerability in Helix workflow and REST

🗓️ 26 Jul 2023 09:30:15Reported by GitHub Advisory DatabaseType

Deserialization vulnerability in Helix workflow and REST. Attackers could potentially execute remote code by exploiting unbounded deserialization using SnakeYAML to load and run code in Helix REST and Workflow creation. Versions 1.2.0 and lower are affected. Mitigation requires ceasing the use of YAML-based configurations and workflow creation, while long-term solution involves upgrading to Helix version 1.3.0

Reporter	Title	Published	Views	Family All 18
Chainguard	CVE-2023-38647 vulnerabilities	26 Jul 202308:15	–	cgr
Circl	CVE-2023-38647	26 Jul 202312:28	–	circl
CNNVD	Apache Helix 代码问题漏洞	26 Jul 202300:00	–	cnnvd
CNVD	Apache Helix Deserialization Vulnerability	30 Jul 202300:00	–	cnvd
CVE	CVE-2023-38647	26 Jul 202307:52	–	cve
Cvelist	CVE-2023-38647 Apache Helix: Deserialization vulnerability in Helix workflow and REST	26 Jul 202307:52	–	cvelist
EUVD	EUVD-2023-2088	3 Oct 202520:07	–	euvd
NVD	CVE-2023-38647	26 Jul 202308:15	–	nvd
OSV	CGA-329M-565Q-R487	29 Jan 202600:42	–	osv
OSV	CGA-CW7P-62MP-G69C	6 Jun 202412:26	–	osv

Vulners

Node

org.apache.helix helix-restRange<1.3.0maven

org.apache.helix helix-coreRange<1.3.0maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-38647
lists	www.lists.apache.org/thread/zyqxhv0lc2z9w3tgr8ttrdy2zfh5jvc4
github	www.github.com/apache/helix/commit/09d210fa29b18f3b4de8d32f2369dc2b31f71f43
github	www.github.com/apache/helix/commit/eabfda26b18c72f4f945dcaac5756665c6a2cdac
github	www.github.com/advisories/GHSA-jhcr-hph9-g7wm

02 Oct 2024 21:40Current

7.3High risk

Vulners AI Score7.3

CVSS 3.19.8

EPSS0.008

SSVC

CWE-502