CVE-2024-36268: Code Injection in Apache InLong

The Code Injection vulnerability in Apache InLong allows an attacker to inject malicious code into the system. Successful exploitation could lead to complete system compromise, including data exfiltration, modification, and denial of service. The attacker could potentially gain control of the InLong cluster and leverage it for further attacks within the network. While no specific real-world exploits have been publicly linked to this vulnerability yet, the potential for RCE makes it a high-priority concern, especially given the complexity of distributed messaging systems like InLong.

1. Reserved2024-05-23
2. Published2024-08-02
3. Modified2024-08-22
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-36268 is to upgrade Apache InLong to version 1.13.0 or later. If immediate upgrading is not feasible, a temporary workaround involves rigorous code review of any user-supplied input to InLong, ensuring proper sanitization and validation to prevent code injection. Implementing strict input validation rules and limiting user privileges can also reduce the attack surface. Monitor InLong logs for any unusual activity or suspicious code execution attempts. The fix is available in the official GitHub pull request: https://github.com/apache/inlong/pull/10251. After upgrading, confirm the fix by attempting to trigger the vulnerable code path with malicious input and verifying that it is properly sanitized.