Apache Rave User Exposure

2013.03.13
Credit: Andreas Guth
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-200


Ogólna skala CVSS: 4/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 8/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Jednorazowa
Wpływ na poufność: Częściowy
Wpływ na integralność: Brak
Wpływ na dostępność: Brak

CVE-2013-1814: Apache Rave exposes User over API Severity: Important Vendor: The Apache Software Foundation Versions Affected: Rave 0.11 to 0.20 Description: Rave returns the full user object, including the salted and hashed password, via the User RPC API. This endpoint is only available to authenticated users, but will return all User objects in the database given the correct query. Mitigation: All users who rely on Rave's user management capabilities should upgrade to 0.20.1 or later. If an upgrade is infeasible, restrict access to the /app/api/user URL paths via Spring Security configuration or other means. Example: A request to: /app/api/rpc/users/get?offset=3DOFFSET will return the following: {"error":false,"errorMessage":null,"errorCode":"NO_ERROR","result":{"result= Set":[{"entityId":1,"username":"canonical","email":"canonical@example.com",= "displayName":"Canonical User","additionalName":"canonical","familyName":"User","givenName":"Canonic= al","honorificPrefix":null,"honorificSuffix":null,"preferredName":null,"abo= utMe":null,"status":"Single","addresses":[],"organizations":[],"properties"= :[{"entityId":1,"type":"thumbnailUrl","value":"http://opensocial2.org:8080/= collabapp/images/avatars/BillRanney.jpg","qualifier":null,"extendedValue":n= ull,"primary":null,"id":"1"}],"password":"$2a$10$TkEgze5kLy9nRlfd8PT1zunh6P= 1ND8WPjLojFjAMNgZMu1D9D1n4.","expired":false,"locked":false,"enabled":true,= "openId":null,"forgotPasswordHash":null,"forgotPasswordTime":null,"defaultP= ageLayout":{"entityId":4,"code":"columns_3","numberOfRegions":3,"renderSequ= ence":3,"userSelectable":true},"confirmPassword":null,"defaultPageLayoutCod= e":null,"authorities":[{"entityId":2,"authority":"ROLE_ADMIN","users":[],"d= efaultForNewUser":false}],"id":"1","accountNonLocked":true,"credentialsNonE= xpired":true,"accountNonExpired":true}, ........ ],"pageSize":10,"offset":0,"totalResults":14,"numberOfPages":2,"cu= rrentPage":1}} Credit: This issue was discovered by Andreas Guth of RWTH Aachen University. References: http://tomcat.apache.org/security.html

Referencje:

http://tomcat.apache.org/security.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top