Apache Lucene.NET, an open-source search library has been discovered having a security flaw that could allow attackers to remotely execute malicious code.
The vulnerability tracked as CVE-2024-43383 with a CVSS score of 8.0, affects the Replicator library in Lucene.NET versions 4.8.0-beta00005 through 4.8.0-beta00016. This flaw stems from the library’s improper handling of untrusted data during deserialization.
Attackers who can intercept traffic between a replication client and server, or manipulate the target replication node URL, can exploit this vulnerability. By injecting a specially crafted JSON response, they can trigger the deserialization of malicious code, potentially granting them full control over the affected system.
Successful exploitation of this vulnerability could have severe consequences not limited to code execution, takeover and data breaches .
The Apache Lucene.NET team has addressed this vulnerability in version 4.8.0-beta00017. All users of affected versions are strongly advised to upgrade to this latest release immediately.
Nice information ✍️🙏