Defense4all security advisory: CVE-2014-8149 users can export report data to an arbitrary file on the server's filesystem

[David Jorm <david.jorm () gmail com>]

It was found that the defense4all framework's "dump" method allows a user
to request that report data is exported to a file on the server's
filesystem. The user can specify any path, and the server will write to it
with no validation. This could be used to perform a range of attacks. For
example, a critical file could be overwritten, thereby disabling the
defense4all server. On Windows servers, a UNC path could be injected,
potentially causing the server to write data to remote filesystems. An
attacker cannot control the contents of the file, but they can define a
report query that returns no results, and therefore force it to write an
empty file. An error message is received if the server cannot write to the
provided path. An attacker could therefore use this issue to map out the
writable filesystem on the server and potentially perform more advanced
attacks by manipulating special files in the /dev and /proc filesystems of
Linux servers.

It was also found that defense4all was using Spring 3.0.0 RC3. This
component is vulnerable to a number of vulnerabilities as listed on the
pivotal advisories page: http://www.pivotal.io/security
Full details including how to apply a patch are available on the
OpenDaylight security advisories page:

https://wiki.opendaylight.org/view/Security_Advisories

Thanks
David Jorm on behalf of the OpenDaylight security response team