CVE-2024-26579
📋 TL;DR
This CVE describes a deserialization vulnerability in Apache InLong that allows attackers to bypass security controls using malicious parameters. Attackers could potentially execute arbitrary code on affected systems. The vulnerability affects Apache InLong versions 1.7.0 through 1.11.0.
💻 Affected Systems
- Apache InLong
📦 What is this software?
Inlong by Apache
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Unauthorized access to sensitive data, service disruption, or privilege escalation within the InLong application.
If Mitigated
Limited impact if proper network segmentation and input validation controls are in place, though risk remains elevated due to CVSS 9.8 rating.
🎯 Exploit Status
The vulnerability allows bypassing security controls via malicious parameters, suggesting relatively straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.12.0
Vendor Advisory: https://lists.apache.org/thread/d2hndtvh6bll4pkl91o2oqxyynhr54k3
Restart Required: Yes
Instructions:
1. Upgrade Apache InLong to version 1.12.0 or later. 2. Alternatively, cherry-pick fixes from GitHub PRs #9694 and #9707. 3. Restart all InLong services after patching.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to InLong services to only trusted sources
iptables -A INPUT -p tcp --dport [INLONG_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [INLONG_PORT] -j DROP
Input Validation Proxy
allDeploy a reverse proxy with strict input validation rules
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to InLong services
- Deploy web application firewall (WAF) with deserialization attack detection rules
🔍 How to Verify
Check if Vulnerable:
Check Apache InLong version using the management interface or configuration files. Versions 1.7.0 through 1.11.0 are vulnerable.Check Version:
Check the version in the InLong web interface or examine the application configuration files for version information.Verify Fix Applied:
Verify version is 1.12.0 or later, or confirm that GitHub PRs #9694 and #9707 have been applied to the codebase.📡 Detection & Monitoring
Log Indicators:
- Unusual deserialization errors
- Unexpected parameter values in requests
- Stack traces containing deserialization-related classes
Network Indicators:
- Unusual traffic patterns to InLong endpoints
- Requests with malformed or unexpected parameter structures
SIEM Query:
source="inlong" AND (error OR exception) AND (deserialization OR ObjectInputStream)🔗 References
- http://www.openwall.com/lists/oss-security/2024/05/09/2
- https://github.com/advisories/GHSA-fgh3-pwmp-3qw3
- https://lists.apache.org/thread/d2hndtvh6bll4pkl91o2oqxyynhr54k3
- http://www.openwall.com/lists/oss-security/2024/05/09/2
- https://github.com/advisories/GHSA-fgh3-pwmp-3qw3
- https://lists.apache.org/thread/d2hndtvh6bll4pkl91o2oqxyynhr54k3
