oss-sec mailing list archives
Defense4all security advisory: CVE-2014-8149 users can export report data to an arbitrary file on the server's filesystem
From: David Jorm <david.jorm () gmail com>
Date: Thu, 22 Jan 2015 10:44:56 +1000
It was found that the defense4all framework's "dump" method allows a user to request that report data is exported to a file on the server's filesystem. The user can specify any path, and the server will write to it with no validation. This could be used to perform a range of attacks. For example, a critical file could be overwritten, thereby disabling the defense4all server. On Windows servers, a UNC path could be injected, potentially causing the server to write data to remote filesystems. An attacker cannot control the contents of the file, but they can define a report query that returns no results, and therefore force it to write an empty file. An error message is received if the server cannot write to the provided path. An attacker could therefore use this issue to map out the writable filesystem on the server and potentially perform more advanced attacks by manipulating special files in the /dev and /proc filesystems of Linux servers. It was also found that defense4all was using Spring 3.0.0 RC3. This component is vulnerable to a number of vulnerabilities as listed on the pivotal advisories page: http://www.pivotal.io/security Full details including how to apply a patch are available on the OpenDaylight security advisories page: https://wiki.opendaylight.org/view/Security_Advisories Thanks David Jorm on behalf of the OpenDaylight security response team
Current thread:
- Defense4all security advisory: CVE-2014-8149 users can export report data to an arbitrary file on the server's filesystem David Jorm (Jan 21)