PT-2022-7464 · Apache+4 · Apache Tomcat+4
Published
2022-02-16
·
Updated
2024-08-15
·
CVE-2022-26520
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
pgjdbc versions prior to 42.3.3
Description
The issue is related to the creation of arbitrary files through the loggerFile and loggerLevel connection properties in the pgjdbc driver. An attacker who controls the jdbc URL or properties can call java.util.logging.FileHandler to write to arbitrary files. This could allow an attacker to create an executable JSP file under a Tomcat web root, potentially leading to remote code execution. The vendor's position is that this is not a vulnerability in the pgjdbc driver itself, but rather a vulnerability in any application that uses the pgjdbc driver with untrusted connection properties.
Recommendations
For versions prior to 42.3.3, consider updating to version 42.3.3 or later, where the loggerFile implementation has been removed.
As a temporary workaround, sanitize the inputs to the driver to prevent misuse of the loggerFile and loggerLevel connection properties.
Restrict access to the jdbc URL and connection properties to prevent untrusted users from specifying arbitrary values.
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Red Os
Suse
Apache Tomcat