CVE-2023-28754 json
ShardingSphere-Agent: Deserialization vulnerability in ShardingSphere Agent
published 2023-07-19 3 y ago modified 2026-06-17 4 mo ago also GHSA-3cxh-xp3g-jxjm , EUVD-2023-1936
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 73%
- public exploits
- 0
- none known
Summary
Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML configuration file.
The attacker needs to have permission to modify the ShardingSphere Agent YAML configuration file on the target machine, and the target machine can access the URL with the arbitrary code JAR. An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. When the ShardingSphere JVM process starts and uses the ShardingSphere-Agent, the arbitrary code specified by the attacker will be executed during the deserialization of the YAML configuration file by the Agent.
This issue affects ShardingSphere-Agent: through 5.3.2. This vulnerability is fixed in Apache ShardingSphere 5.4.0.
Patch / fix
- maven org.apache.shardingsphere:shardingsphere 5.4.0
- apache shardingsphere 5.4.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.46% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.shardingsphere:shardingsphere | <5.4.0 |
5.4.0 |
Affected products
- Apache Software Foundation ShardingSphere-Agent
- apache shardingsphere
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
lists.apache.org
/thread/p8onhqox5kkwow9lc6gs03z28wtyp1cg
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2023/07/19/3
web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2023-28754
advisory
-
github.com
/apache/shardingsphere
package
Sources
- CVE List CVE-2023-28754
- GitHub Advisory GHSA-3cxh-xp3g-jxjm
- NVD CVE-2023-28754
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.