Apache Inlong Code Injection vulnerability

The Code Injection vulnerability in Apache InLong allows an attacker to inject malicious code into the system. Successful exploitation could lead to complete system compromise, including data exfiltration, modification, and denial of service. The attacker could potentially gain control of the InLong cluster and leverage it for further attacks within the network. While no specific real-world exploits have been publicly linked to this vulnerability yet, the potential for RCE makes it a high-priority concern, especially given the complexity of distributed messaging systems like InLong.

Organizations utilizing Apache InLong for data streaming and messaging, particularly those running versions 1.10.0 through 1.12.0, are at risk. This includes companies relying on InLong for real-time data pipelines, event-driven architectures, and integration with other systems. Shared hosting environments where InLong instances are deployed alongside other applications should be especially vigilant.

• linux / server:

journalctl -u tubemq-core -f | grep -i "injection"

• java / supply-chain: Inspect InLong configuration files for any user-supplied data that is directly incorporated into code execution paths. • generic web: Monitor InLong's access logs for unusual patterns or requests that attempt to inject code.

1. 2024-08-02Disclosure

   disclosure

1. Reservado2024-05-23
2. Publicada2024-08-02
3. Modificada2024-08-22
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-36268 is to upgrade Apache InLong to version 1.13.0 or later. If immediate upgrading is not feasible, a temporary workaround involves rigorous code review of any user-supplied input to InLong, ensuring proper sanitization and validation to prevent code injection. Implementing strict input validation rules and limiting user privileges can also reduce the attack surface. Monitor InLong logs for any unusual activity or suspicious code execution attempts. The fix is available in the official GitHub pull request: https://github.com/apache/inlong/pull/10251. After upgrading, confirm the fix by attempting to trigger the vulnerable code path with malicious input and verifying that it is properly sanitized.