CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)
A vulnerability was found in Apache Avro. The project would be affected if it accepts an Avro schema for parsing provided by the end-user. By using the special "java-class" attribute an attacker can trigger remote code execution. The issue is fixed in Avro 1.11.4 and 1.12.0.
Other sources
Apache Avro could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in schema parsing in the Java SDK. By sending a specially crafted request using the "java-class" attribute, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47561?
CVE-2024-47561 is a critical vulnerability due to potential remote code execution risks in Apache Avro.
How do I fix CVE-2024-47561?
To fix CVE-2024-47561, upgrade to Apache Avro version 1.11.4 or later.
What versions of Apache Avro are affected by CVE-2024-47561?
CVE-2024-47561 affects all versions of Apache Avro prior to 1.11.4.
Can CVE-2024-47561 be exploited by untrusted users?
Yes, CVE-2024-47561 can be exploited if Apache Avro is configured to accept schemas from untrusted users.
What should I do if I cannot upgrade to fix CVE-2024-47561?
If upgrading is not possible, implement strict input validation and avoid accepting user-defined schemas to mitigate CVE-2024-47561.