CVE-2022-24082: Pega Infinity RCE Vulnerability

CVE-2022-24082 Overview

CVE-2022-24082 is a critical insecure deserialization vulnerability affecting on-premise installations of the Pega Platform. When the JMX (Java Management Extensions) interface port is exposed to the Internet without proper port filtering, attackers can upload serialized payloads to execute arbitrary code on the underlying system. This vulnerability does not affect systems running on PegaCloud due to its inherent design and architecture.

Critical Impact

Unauthenticated remote attackers can achieve complete system compromise through serialized payload injection via exposed JMX interfaces, potentially leading to full control of the affected Pega Platform installation.

Affected Products

• Pega Infinity (on-premise installations)
• Pega Platform versions with exposed JMX interfaces
• Systems without proper network port filtering configuration

Discovery Timeline

• 2022-07-19 - CVE CVE-2022-24082 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24082

Vulnerability Analysis

This vulnerability stems from insecure deserialization (CWE-502) in the Pega Platform's JMX interface. The JMX interface, a standard Java technology for monitoring and managing applications, accepts serialized Java objects for remote method invocation. When this interface is exposed to untrusted networks without authentication or proper filtering, attackers can craft malicious serialized objects that execute arbitrary code upon deserialization.

The attack requires no privileges or user interaction, making it highly exploitable in misconfigured environments. The impact extends to complete compromise of confidentiality, integrity, and availability of the affected system. An exploit is publicly available through Packet Storm Security, significantly increasing the risk profile for exposed installations.

Root Cause

The root cause lies in the combination of two factors: the JMX interface's inherent capability to accept and deserialize Java objects, and misconfiguration that exposes this interface to untrusted networks. Java deserialization vulnerabilities occur when applications deserialize untrusted data without proper validation. Attackers can leverage gadget chains present in the application's classpath to construct payloads that execute arbitrary commands when deserialized. The Pega Platform's use of common Java libraries provides the necessary gadget chains for exploitation.

Attack Vector

The attack is network-based and targets exposed JMX service ports (typically port 1099 for RMI registry or custom-configured ports). An attacker first identifies an exposed JMX interface through network scanning. They then craft a malicious serialized Java object containing a payload that leverages available gadget chains in the Pega Platform's classpath. When the JMX interface receives and deserializes this object, the malicious code executes with the privileges of the Pega Platform process.

The exploitation process involves connecting to the exposed JMX port, sending a specially crafted serialized payload using tools like ysoserial or custom exploit code, and achieving code execution on the target server. The Packet Storm RCE Exploit demonstrates this attack against Pega Platform version 8.7.3.

Detection Methods for CVE-2022-24082

Indicators of Compromise

• Unexpected inbound connections to JMX ports (commonly 1099, 1098, or custom RMI ports) from external IP addresses
• Unusual Java process spawning child processes (cmd.exe, powershell.exe, /bin/sh, /bin/bash)
• Serialized Java objects in network traffic containing known gadget chain class names (e.g., CommonsCollections, CommonsBeanutils)
• Anomalous outbound connections from the Pega Platform server to unknown destinations

Detection Strategies

• Monitor network traffic for connections to JMX/RMI ports from untrusted sources using firewall logs and network monitoring tools
• Implement Java deserialization attack detection rules in IDS/IPS systems to identify malicious serialized payloads
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process chains originating from Java processes
• Review application logs for deserialization errors or exceptions that may indicate exploitation attempts

Monitoring Recommendations

• Enable logging for all JMX interface access attempts and authentication failures
• Configure network monitoring to alert on any external connections to RMI registry ports
• Implement file integrity monitoring on critical Pega Platform directories
• Monitor for new or unexpected scheduled tasks and startup items on Pega servers

How to Mitigate CVE-2022-24082

Immediate Actions Required

• Audit network configuration to identify any JMX ports exposed to the Internet and immediately restrict access using firewall rules
• Apply the appropriate hotfix from Pega Security Advisory B22 based on your Pega Platform version
• Implement network segmentation to ensure JMX interfaces are only accessible from trusted management networks
• Enable JMX authentication and SSL/TLS encryption if JMX remote access is required

Patch Information

Pega has released hotfixes addressing this vulnerability. Organizations should consult the Pega Security Advisory B22 hotfix matrix to identify the appropriate patch for their specific Pega Platform version. PegaCloud customers are not affected due to the platform's design and architecture.

Workarounds

• Block all external access to JMX ports at the network perimeter using firewall rules
• If JMX must remain accessible, implement IP whitelisting to restrict access to known management stations only
• Consider disabling remote JMX access entirely if not required for operational purposes
• Deploy a VPN or jump host architecture for remote administration needs

# Example firewall rules to block external JMX access
# Linux iptables - block external access to common JMX ports
iptables -A INPUT -p tcp --dport 1099 -s ! 10.0.0.0/8 -j DROP
iptables -A INPUT -p tcp --dport 1098 -s ! 10.0.0.0/8 -j DROP

# Allow JMX only from specific management subnet
iptables -A INPUT -p tcp --dport 1099 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1099 -j DROP