Leaking deserialization protection on Externalizables

[kwart]

The deserialization filter doesn't properly protect against vulnerable Externalizable classes. The filtering has to be extended.

The issue was discovered by @Mak-Sym and reported on Hazelcast google group - https://groups.google.com/forum/#!topic/hazelcast/B_RAv7gTVPU.

[andrewfinnell]

Would it be possible for someone to describe specifically how an attacker might use this vulnerability? From what I am reading it sounds like an attacker would need to send a malformed Join request that tricks Hazelcast into deserializing a rogue class that is on the classpath of the service accepting the join request. Is that accurate?

[mmedenjak]

@kwart can you provide an answer for the question or confirm it?

[kwart]

Would it be possible for someone to describe specifically how an attacker might use this vulnerability? From what I am reading it sounds like an attacker would need to send a malformed Join request that tricks Hazelcast into deserializing a rogue class that is on the classpath of the service accepting the join request. Is that accurate?

We don't publish details on attack vectors. Sorry.