CVE-2023-46801
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary code on Apache Linkis servers by exploiting Java deserialization when adding MySQL data sources. It affects Apache Linkis versions up to 1.5.0 running on Java versions older than 1.8.0_241. Attackers need valid Linkis credentials to exploit this vulnerability.
💻 Affected Systems
- Apache Linkis
📦 What is this software?
Linkis by Apache
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary commands, steal data, install persistent backdoors, and pivot to other systems in the network.
Likely Case
Authenticated attackers with legitimate access can execute arbitrary code to exfiltrate sensitive data, modify configurations, or disrupt services.
If Mitigated
With proper network segmentation and access controls, impact is limited to the affected Linkis instance only.
🎯 Exploit Status
Exploitation requires authenticated access to Linkis and knowledge of Java deserialization attacks via JRMP
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.0
Vendor Advisory: https://lists.apache.org/thread/0dnzh64xy1n7qo3rgo2loz9zn7m9xgdx
Restart Required: Yes
Instructions:
1. Upgrade Apache Linkis to version 1.6.0 or later. 2. Alternatively, upgrade Java to version 1.8.0_241 or later. 3. Restart all Linkis services after upgrade.
🔧 Temporary Workarounds
Disable MySQL data source functionality
allTemporarily disable the ability to add MySQL data sources in Linkis configuration
Modify Linkis configuration to remove or restrict MySQL data source modules
Upgrade Java runtime
linuxUpgrade Java to version 1.8.0_241 or later to mitigate the deserialization vulnerability
sudo apt-get update && sudo apt-get install openjdk-8-jdk
java -version
🧯 If You Can't Patch
- Restrict network access to Linkis instances to only trusted users and systems
- Implement strict access controls and monitor for unusual data source creation activities
🔍 How to Verify
Check if Vulnerable:
Check Linkis version with: linkis version command or check installation directory. Verify Java version with: java -versionCheck Version:
java -version && check Linkis version in web UI or configuration filesVerify Fix Applied:
Confirm Linkis version is >= 1.6.0 and Java version is >= 1.8.0_241📡 Detection & Monitoring
Log Indicators:
- Unusual data source creation events
- Java deserialization errors in logs
- Unexpected process execution from Linkis services
Network Indicators:
- JRMP connections to/from Linkis servers
- Unusual outbound connections from Linkis instances
SIEM Query:
source="linkis.log" AND ("data source" OR "mysql" OR "deserialization")