Pega Platform 6.x 版本到 Infinity 24.1.1 受到代码生成控制不当的问题影响

The Improper Control of Code Generation vulnerability in Pega Infinity presents a significant risk. An attacker who successfully exploits this flaw could inject malicious code into the platform's processes, leading to remote code execution (RCE). This could allow them to gain unauthorized access to sensitive data, modify system configurations, install malware, or even take complete control of the affected Pega Infinity instance. The potential blast radius is substantial, as a compromised Pega Infinity deployment could impact numerous downstream applications and business processes that rely on it. The ability to generate arbitrary code opens the door to a wide range of attacks, including data exfiltration, denial of service, and privilege escalation.

Organizations heavily reliant on Pega Infinity for critical business processes are at significant risk. This includes companies in industries such as financial services, healthcare, and government, where data security and system integrity are paramount. Specifically, deployments using custom code generation features or integrations with external systems are particularly vulnerable.

• java / server: Monitor Pega Infinity logs for unusual code generation activity. Look for patterns indicative of code injection attempts.

grep -i 'error|exception|code generation' /path/to/pega/logs/*

• java / supply-chain: Examine Pega Infinity's dependencies for known vulnerabilities that could be chained with this vulnerability. Use dependency scanning tools. • generic web: Monitor Pega Infinity endpoints for unexpected behavior or responses that might indicate code execution. • database (mysql, redis, mongodb, postgresql): N/A - This vulnerability is not directly related to database systems. • wordpress / composer / npm: N/A - This vulnerability is not related to these platforms.

1. 2024-11-20Disclosure

   disclosure

1. 已保留2024-10-17
2. 发布日期2024-11-20
3. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-10094 is to upgrade to Pega Infinity version 24.1.2 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds. While a direct workaround is not specified, restrict access to code generation functionalities to authorized personnel only. Review and audit all code generation processes to identify any potential vulnerabilities. Implement robust input validation and sanitization to prevent malicious code from being injected. After upgrading, confirm the fix by attempting to trigger the vulnerable code generation process with a known malicious payload and verifying that it is blocked.