CVE-2020-1952
📋 TL;DR
Apache IoTDB versions 0.8.0-0.8.2 and 0.9.0-0.9.1 expose JMX port 31999 without authentication when starting. This allows unauthenticated remote attackers to execute arbitrary code on affected systems. All IoTDB deployments using vulnerable versions are affected.
💻 Affected Systems
- Apache IoTDB
📦 What is this software?
Iotdb by Apache
Iotdb by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Remote code execution leading to data theft, service disruption, or cryptocurrency mining.
If Mitigated
No impact if JMX port is properly secured or inaccessible from untrusted networks.
🎯 Exploit Status
Direct JMX access without authentication makes exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.2 or later, 0.8.3 or later
Vendor Advisory: https://lists.apache.org/thread.html/r3d2ff899ead64d2952fdc1fbb1f520ca42011ed2b4c7f786e921f6b9%40%3Cdev.iotdb.apache.org%3E
Restart Required: Yes
Instructions:
1. Download patched version (0.9.2+ or 0.8.3+). 2. Stop IoTDB service. 3. Backup configuration and data. 4. Install patched version. 5. Restart IoTDB service.
🔧 Temporary Workarounds
Block JMX port with firewall
allPrevent external access to JMX port 31999
iptables -A INPUT -p tcp --dport 31999 -j DROP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="31999" protocol="tcp" reject'
netsh advfirewall firewall add rule name="Block IoTDB JMX" dir=in action=block protocol=TCP localport=31999
Disable JMX entirely
allConfigure IoTDB to disable JMX exposure
Edit iotdb-env.sh and set JMX_ENABLE=false
Add -Dcom.sun.management.jmxremote=false to JVM options
🧯 If You Can't Patch
- Implement strict network segmentation to isolate IoTDB from untrusted networks
- Deploy host-based firewall rules to restrict access to port 31999 to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check IoTDB version with 'iotdb version' command and verify if it's in vulnerable range. Test if port 31999 is open and accessible without authentication.Check Version:
iotdb versionVerify Fix Applied:
Verify version is 0.9.2+ or 0.8.3+. Test that JMX port requires authentication or is not exposed.📡 Detection & Monitoring
Log Indicators:
- Unauthorized connection attempts to port 31999
- Unusual JMX operations or MBean access
Network Indicators:
- External connections to TCP port 31999
- JMX protocol traffic from unexpected sources
SIEM Query:
destination_port=31999 AND (source_ip NOT IN [trusted_ips])