PT-2020-12965 · Apache · Apache Karaf

Colm O Heigeartaigh · Published 2020-06-12 · Updated 2022-02-10 · CVE-2020-11980

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Karaf versions prior to 4.2.9

Description The issue concerns JMX authentication and authorization in Karaf, where a user with a "viewer" role can invoke certain methods, potentially leading to a SSRF style attack and privilege escalation by polluting the MBean registry. By default, only an "admin" can invoke on an MBean, but a "viewer" role can call get* methods. An attacker can authenticate as a "viewer" and invoke the MLet getMBeansFromURL method, which fetches an MBean from a remote server and registers it in Karaf. Although the attack fails due to lack of permission to invoke on the MBean, it can still cause issues. The vulnerability can be mitigated by adding an ACL to limit access.

Recommendations Update to Apache Karaf 4.2.9 or newer. As a temporary workaround, consider adding an ACL to limit access to the getMBeansFromURL method for "viewer" roles. Restrict access to the MLet getMBeansFromURL method to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-11980

GHSA-9JG9-6WM2-X7P5

Affected Products

Apache Karaf

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-11980 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11980 · Vendor Advisory
• http://karaf.apache.org/security/cve-2020-11980.txt · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9jg9-6wm2-x7p5 · Vendor Advisory
• https://github.com/apache/karaf/commit/3e4c4bed2d08e81ca5961ab5fcadab23470db1c9 · Note
• https://t.me/cvenotify/4339 · Telegram Post