CVE-2024-45772: Apache Lucene Replicator Vulnerability

CVE-2024-45772 Overview

CVE-2024-45772 is an Insecure Deserialization vulnerability affecting Apache Lucene's Replicator module. The vulnerability exists in the deprecated org.apache.lucene.replicator.http package, which fails to properly validate untrusted data during deserialization operations. This flaw affects Apache Lucene Replicator versions from 4.4.0 before 9.12.0.

The deserialization vulnerability can only be triggered if users actively deploy a network-accessible implementation and a corresponding client using an HTTP library that utilizes the API (e.g., a custom servlet and HTTPClient). Notably, the org.apache.lucene.replicator.nrt package is not affected by this vulnerability.

Critical Impact

Successful exploitation could allow attackers with adjacent network access to execute arbitrary code by sending malicious serialized objects to vulnerable Apache Lucene Replicator implementations, potentially leading to complete system compromise.

Affected Products

• Apache Lucene Replicator versions 4.4.0 through 9.11.x
• Applications using the deprecated org.apache.lucene.replicator.http package
• Custom servlets and HTTP clients implementing the vulnerable API

Discovery Timeline

• September 30, 2024 - CVE-2024-45772 published to NVD
• May 15, 2025 - Last updated in NVD database

Technical Details for CVE-2024-45772

Vulnerability Analysis

The vulnerability stems from unsafe deserialization practices in Apache Lucene's Replicator module. Deserialization vulnerabilities occur when an application deserializes untrusted data without proper validation, allowing attackers to manipulate the serialized object stream to achieve malicious outcomes.

In the context of CVE-2024-45772, the deprecated org.apache.lucene.replicator.http package processes serialized Java objects from HTTP requests without adequate integrity checks. When a vulnerable implementation is deployed with network accessibility, an attacker on an adjacent network segment can craft malicious serialized objects that, when deserialized, trigger arbitrary code execution on the target system.

The exploitation requires low privileges and no user interaction, making it a significant threat in environments where the vulnerable component is exposed. The impact encompasses confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of CVE-2024-45772 is the use of Java native deserialization on untrusted input within the org.apache.lucene.replicator.http package. Java's ObjectInputStream class, when used without proper filtering, will instantiate any serializable class available on the classpath. Attackers can leverage this behavior to chain together "gadget" classes to achieve remote code execution.

The deprecated nature of the affected package suggests that safer alternatives exist, but legacy deployments may still rely on this functionality without awareness of the security implications.

Attack Vector

The attack vector requires adjacent network access to the vulnerable Apache Lucene Replicator deployment. The attacker must be able to send HTTP requests to a custom servlet or implementation that uses the vulnerable HTTP-based replication API.

An attacker would craft a malicious serialized Java object containing a carefully constructed object graph. When the vulnerable application deserializes this payload, the object instantiation and method calls during deserialization can be exploited to execute arbitrary code. Common exploitation chains leverage classes from libraries like Apache Commons Collections, Spring Framework, or other dependencies that may be present on the application's classpath.

The attack does not require user interaction and can be automated once a vulnerable endpoint is identified.

Detection Methods for CVE-2024-45772

Indicators of Compromise

• Unusual HTTP POST requests containing binary Java serialization data (magic bytes 0xAC 0xED) targeting Lucene Replicator endpoints
• Unexpected process spawning or command execution originating from Java application processes
• Anomalous network connections initiated by the application server to external hosts
• Log entries indicating deserialization errors or class instantiation failures for unexpected classes

Detection Strategies

• Monitor network traffic for Java serialization magic bytes (0xAC 0xED 0x00 0x05) in HTTP request bodies to Lucene Replicator endpoints
• Implement Java deserialization monitoring using JVM-level instrumentation or security agents
• Review application logs for deserialization-related exceptions or errors that may indicate exploitation attempts
• Deploy network intrusion detection signatures for known Java deserialization exploit patterns

Monitoring Recommendations

• Enable verbose logging for the Apache Lucene Replicator components to capture detailed request information
• Implement application performance monitoring (APM) to detect anomalous behavior patterns in request processing
• Configure alerting for process execution chains originating from Java processes running vulnerable applications
• Conduct regular vulnerability scanning of applications using Apache Lucene dependencies

How to Mitigate CVE-2024-45772

Immediate Actions Required

• Upgrade Apache Lucene to version 9.12.0 or later, which contains the fix for this vulnerability
• Audit applications to identify usage of the deprecated org.apache.lucene.replicator.http package
• Implement network segmentation to limit adjacent network access to vulnerable deployments
• Apply Java serialization filters as a temporary mitigation if immediate patching is not possible

Patch Information

Apache has released version 9.12.0 of Apache Lucene, which addresses this deserialization vulnerability. Users are strongly recommended to upgrade to this version or later. For detailed information about the patch and upgrade instructions, refer to the Apache Security Mailing List Thread and the OpenWall OSS-Security Post.

Workarounds

• Apply Java serialization filters using the JVM flag -Djdk.serialFilter='!*' to block all deserialization, which mitigates the vulnerability without impacting functionality
• Migrate from the deprecated org.apache.lucene.replicator.http package to the unaffected org.apache.lucene.replicator.nrt package
• Restrict network access to Lucene Replicator endpoints using firewall rules or application-layer access controls
• Implement a Web Application Firewall (WAF) rule to inspect and block requests containing Java serialization payloads

# Apply Java serialization filter to block deserialization attacks
# Add this JVM argument when starting the application
java -Djdk.serialFilter='!*' -jar your-application.jar

# Alternative: Create a more specific filter if complete blocking impacts functionality
java -Djdk.serialFilter='!org.apache.commons.collections.*;!org.springframework.*' -jar your-application.jar