Headline
CVE-2022-24082: Collaboration Center
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.
F****or On-Premises clients only.
(Pega has already mitigated this vulnerability for Pega Cloud and Pega Cloud for Government clients.)
Pega continually works to implement security controls designed to protect client environments.
With this focus, Pega has issued hotfixes for a critical security vulnerability in Pega Platform, which impacts Pega Platform versions 8.1.0 and higher. We would like to thank Marcin Wolak at RaboBank for finding this vulnerability.
For on-premises clients, there is the potential for malicious actors to run Remote Code Execution using the JMX interface on Cassandra and Kafka in situations where clients leave unneeded network ports exposed. Clients could mitigate this vulnerability by closing all unneeded ports, but any future infrastructure changes could re-expose the client; therefore, Pega strongly recommends that clients install the hotfix to reduce the risk of accidental exposure.
To block malicious actors from exploiting this vulnerability, Pega has created the B22 Hotfix for each relevant version to remediate this issue. If you are an on–premises client, please review the table below to determine which hotfix corresponds to your Pegasystems installation. Once you have determined the appropriate hotfix ID, please submit a hotfix request using My Support Portal. As always, be sure you have appropriate backups in place before applying the hotfix. Note that a system restart will be required for the hotfix to take effect; also, clients must ensure they are running Java version 8u111 or later.
As always, we recommend our clients review our Security Checklist regularly.
Hotfix list:
Version
Hotfix No.
8.1
HFIX-83289
8.1.1
HFIX-83288
8.1.2
HFIX-83287
8.1.3
HFIX-83286
8.1.4
HFIX-83285
8.1.5
HFIX-83284
8.1.6
HFIX-83283
8.1.7
HFIX-83282
8.1.8
HFIX-83281
8.1.9
HFIX-83280
8.2.1
HFIX-83249
8.2.2
HFIX-83248
8.2.3
HFIX-83247
8.2.4
HFIX-83246
8.2.5
HFIX-83245
8.2.6
HFIX-83244
8.2.7
HFIX-83243
8.2.8
HFIX-83242
8.3.0
HFIX-83279
8.3.1
HFIX-83278
8.3.2
HFIX-83277
8.3.3
HFIX-83276
8.3.4
HFIX-83275
8.3.5
HFIX-83274
8.3.6
HFIX-83273
8.4.0
HFIX-83272
8.4.1
HFIX-83271
8.4.2
HFIX-83270
8.4.3
HFIX-83269
8.4.4
HFIX-83268
8.4.5
HFIX-83267
8.4.6
HFIX-83266
8.5.1
HFIX-83265
8.5.2
HFIX-83264
8.5.3
HFIX-83263
8.5.4
HFIX-83262
8.5.5
HFIX-83261
8.5.6
HFIX-83260
8.6.0
HFIX-83259
8.6.1
HFIX-83258
8.6.2
HFIX-83257
8.6.3
HFIX-83256
8.6.4
HFIX-83255
8.6.5
HFIX-83865
8.7
HFIX-83254
8.7.1
HFIX-83253
8.7.2
HFIX-83651
Related news
Pega Platform versions 8.1.0 through 8.7.3 suffer from a remote code execution vulnerability. If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.