CVE-2022-36364
Published: 28 July 2022
Summary
CVE-2022-36364 is a high-severity Improper Initialization (CWE-665) vulnerability in Apache Apache Calcite Avatica. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is an insecure instantiation flaw (CWE-665) in the Apache Calcite Avatica JDBC driver. When processing the httpclient_impl connection property, the driver instantiates an arbitrary class name without first confirming that the class implements the expected HTTP client interface. This affects all releases prior to Avatica 1.22.0 and can result in attacker-controlled code being loaded and executed.
An attacker who can supply or modify JDBC connection parameters, and who can ensure a suitably constructed class (one accepting a URL in its constructor and performing code execution) is present on the classpath, can trigger local or, in rare configurations, remote code execution. The attack requires low complexity and no user interaction, yielding full confidentiality, integrity, and availability impact as reflected in the CVSS 8.8 score.
Advisories from the Apache Calcite project and oss-security lists state that version 1.22.0 and later enforce an explicit interface check before constructor invocation. The EPSS score has remained flat at 0.1179 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6428
Vulnerability details
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution…
more
loaded via arbitrary classes and in rare cases remote code execution. To exploit the vulnerability: 1) the attacker needs to have privileges to control JDBC connection parameters; 2) and there should be a vulnerable class (constructor with URL parameter and ability to execute code) in the classpath. From Apache Calcite Avatica 1.22.0 onwards, it will be verified that the class implements the expected interface before invoking its constructor.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ensures shared resources are explicitly initialized or cleared on allocation, preventing exposure of prior contents to new users or processes.
Mandates that every instance begins in a known (presumably clean) state, eliminating reliance on residual or uninitialized state left by prior executions.