Skip to content

(2025.06 - 2026.03) Pre-auth remote code execution in DCV Session Manager broker #180

Description

@junbo75

Bug description

The DCV Session Manager broker installed on RES broker hosts includes Apache Ignite < 2.17.0, which is affected by CVE-2024-52577, a pre-authentication remote code execution vulnerability via unsafe Java deserialization. An attacker with network access to the broker could execute arbitrary code on the broker host.

Affected versions

2025.06 - 2026.03

Mitigation

The fix is delivered via the upstream DCV Session Manager broker package (version 2025.0.561), which upgrades Apache Ignite to 2.18.0. RES environments pull the latest broker RPM from CloudFront using unversioned URLs, so the fix is automatically picked up when a new broker host is launched.

To apply the fix, cycle the current DCV broker instance and let the Auto Scaling Group launch a new one with the patched broker package. We strongly recommend running these CLI commands in AWS CloudShell — a free, browser-based shell pre-authenticated with your console credentials.

  1. Configure the AWS CLI for the account/region where RES is deployed.
  2. Terminate the current broker instance:
ENVIRONMENT_NAME=<environment-name>

INSTANCE_ID=$(aws ec2 describe-instances \
            --filters \
            Name=tag:Name,Values=${ENVIRONMENT_NAME}-vdc-broker \
            Name=tag:res:EnvironmentName,Values=${ENVIRONMENT_NAME} \
            --query "Reservations[0].Instances[0].InstanceId" \
            --output text)
    
aws ec2 terminate-instances --instance-ids ${INSTANCE_ID}
  1. The Auto Scaling Group will automatically launch a new broker instance with the latest DCV Session Manager broker package containing the fix.
  2. Verify the new DCV Broker instance is healthy by checking that its associated target groups show a healthy status in the Amazon EC2 console under Load Balancing > Target Groups. Look for target groups containing <environment-name>-broker in the name for your environment.
  3. Connect to the new broker instance and verify the broker version is 2025.0.561 or higher:
rpm -q nice-dcv-session-manager-broker
# Expected output: nice-dcv-session-manager-broker-2025.0.561-1.amzn2023.noarch (or higher)

Rollback

No rollback is needed. The fix is a standard upstream package upgrade of the DCV Session Manager broker. The new broker instance will always pull the latest available version from CloudFront. Rolling back would require pinning an older broker version, which is not recommended as it would reintroduce the vulnerability.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions