Apache Ignite Class Serialization Filter Bypass Vulnerability Leading to Remote Code Execution

A remote code execution vulnerability exists in Apache Ignite versions 2.6.0 prior to 2.17.0. In these versions, Class Serialization Filters are not properly enforced on certain server endpoints. This flaw can be exploited by sending a crafted Ignite message containing a vulnerable object from the server's classpath to the server endpoints. If the server deserializes this message, it may execute arbitrary code, potentially compromising the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the Apache Ignite server.