PT-2017-9772 · Apache · Apache Brooklyn

Toshitsugu Yoneyama · Published 2017-09-13 · Updated 2022-05-17 · CVE-2016-8737

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Brooklyn versions prior to 0.10.0

Description The issue allows a malicious web site to produce a link that, if clicked while a user is logged in, could cause the server to execute the attacker's commands as the user. This is due to the REST server being vulnerable to cross-site request forgery (CSRF). A proof-of-concept exploit using this issue is known to exist.

Recommendations For versions prior to 0.10.0, update to version 0.10.0 or later to resolve the issue. As a temporary workaround, consider implementing CSRF protection mechanisms, such as token-based validation, to minimize the risk of exploitation. Restrict access to sensitive operations within the REST server to minimize potential damage until the update can be applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2016-8737

GHSA-G2HF-G7FH-VG92

Affected Products

Apache Brooklyn

References · 9

• 🔥 https://lists.apache.org/thread.html/877813aaaa0e636adbc36106b89a54e0e6918f0884e9c8b67d5d5953@%3Cdev.brooklyn.apache.org%3E · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-8737 · Security Note
• https://osv.dev/vulnerability/GHSA-g2hf-g7fh-vg92 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8737 · Vendor Advisory
• https://brooklyn.apache.org/community/security/CVE-2016-8737.html · Vendor Advisory
• https://github.com/apache/brooklyn-server/pull/430 · Note
• https://github.com/apache/brooklyn-ui/pull/37 · Note
• http://securityfocus.com/bid/96228 · Note
• https://lists.apache.org/thread.html/877813aaaa0e636adbc36106b89a54e0e6918f0884e9c8b67d5d5953%40%3Cdev.brooklyn.apache.org%3E · Note