CVE-2022-36364
📋 TL;DR
This vulnerability in Apache Calcite Avatica JDBC driver allows attackers with JDBC connection parameter privileges to execute arbitrary code by loading malicious classes via the 'httpclient_impl' property. It affects systems using vulnerable versions of the driver where attackers can control connection parameters. The risk is highest when untrusted users can configure JDBC connections or when vulnerable classes exist in the classpath.
💻 Affected Systems
- Apache Calcite Avatica JDBC Driver
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Privileged users with JDBC configuration access could execute arbitrary code within the application context.
If Mitigated
Limited to authenticated users with specific JDBC configuration privileges, reducing attack surface.
🎯 Exploit Status
Exploitation requires: 1) JDBC connection parameter privileges, 2) Vulnerable class in classpath, 3) Knowledge of exploitable class names.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apache Calcite Avatica 1.22.0 and later
Vendor Advisory: https://lists.apache.org/thread/5csdj8bv4h3hfgw27okm84jh1j2fyw0c
Restart Required: Yes
Instructions:
1. Identify all applications using Apache Calcite Avatica JDBC driver. 2. Update to version 1.22.0 or later. 3. Replace the avatica-core.jar file. 4. Restart all affected applications. 5. Verify the update by checking the driver version.
🔧 Temporary Workarounds
Restrict JDBC Connection Parameters
allLimit who can configure JDBC connection properties, especially 'httpclient_impl'.
Classpath Sanitization
allRemove or restrict potentially dangerous classes from the application classpath.
🧯 If You Can't Patch
- Implement strict access controls on JDBC connection configuration
- Use application firewalls to monitor and block suspicious JDBC connection attempts
🔍 How to Verify
Check if Vulnerable:
Check if using Apache Calcite Avatica JDBC driver version < 1.22.0 and if 'httpclient_impl' property is configurable.Check Version:
Check the avatica-core.jar manifest or use: java -cp avatica-core.jar org.apache.calcite.avatica.Main --versionVerify Fix Applied:
Verify the driver version is 1.22.0 or later and test that arbitrary classes cannot be loaded via 'httpclient_impl'.📡 Detection & Monitoring
Log Indicators:
- Unusual class loading errors
- JDBC connection attempts with custom 'httpclient_impl' values
- Security manager violations
Network Indicators:
- Unexpected outbound connections from JDBC driver
- HTTP requests to unusual endpoints
SIEM Query:
Search for: 'httpclient_impl' in application logs OR 'ClassNotFoundException' for suspicious class names