CVE-2024-56518
📋 TL;DR
CVE-2024-56518 allows remote attackers to execute arbitrary code on Hazelcast Management Center servers by uploading a malicious hazelcast-client XML configuration file containing a JNDI injection payload. This affects all Hazelcast Management Center deployments up to version 6.0 that expose the cluster-connections endpoint. Attackers can achieve full system compromise without authentication.
💻 Affected Systems
- Hazelcast Management Center
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with attacker gaining root/admin privileges, deploying ransomware, stealing sensitive data, and pivoting to other internal systems.
Likely Case
Remote code execution leading to data theft, cryptocurrency mining, or deployment of backdoors for persistent access.
If Mitigated
Limited impact if network segmentation prevents external access and file uploads are restricted to trusted sources only.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available. Exploitation requires crafting a malicious XML file with JNDI injection payload and uploading it via HTTP POST to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available as of current information
Vendor Advisory: No official vendor advisory found at time of analysis
Restart Required: No
Instructions:
1. Monitor Hazelcast security advisories for official patch. 2. Apply workarounds immediately. 3. Consider upgrading to newer versions if available.
🔧 Temporary Workarounds
Disable cluster-connections endpoint
allRemove or restrict access to the vulnerable /cluster-connections URI
Configure web server (nginx/apache) to block /cluster-connections
Use firewall rules to block access to the endpoint
Network segmentation
linuxRestrict network access to Hazelcast Management Center
iptables -A INPUT -p tcp --dport [management-center-port] -s [trusted-ips] -j ACCEPT
iptables -A INPUT -p tcp --dport [management-center-port] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit Management Center access to trusted IPs only
- Deploy a web application firewall (WAF) with rules to block malicious XML uploads and JNDI injection patterns
🔍 How to Verify
Check if Vulnerable:
Check if Hazelcast Management Center version is 6.0 or earlier and if /cluster-connections endpoint is accessible via HTTP requestsCheck Version:
Check Management Center web interface or configuration files for version informationVerify Fix Applied:
Verify that /cluster-connections endpoint is no longer accessible or properly secured, and test with safe payloads to confirm RCE is prevented📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /cluster-connections
- XML file uploads with JNDI patterns
- Unusual process execution from Management Center service
Network Indicators:
- Outbound LDAP/RMI connections from Management Center server
- HTTP requests containing JNDI payloads in XML
SIEM Query:
source="hazelcast-mc" AND (uri="/cluster-connections" OR method="POST") AND (body="JndiLoginModule" OR body="user.provider.url")