CVE-2020-11980

Description

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the etc/jmx.acl.cfg, such as role can call get*. Its possible to authenticate as a viewer role + invokes on the MLet getMBeansFromURL method, which goes off to a remote server to fetch the desired MBean, which is then registered in Karaf. At this point the attack fails as "viewer" doesnt have the permission to invoke on the MBean. Still, it could act as a SSRF style attack and also it essentially allows a "viewer" role to pollute the MBean registry, which is a kind of privilege escalation. The vulnerability is low as its possible to add a ACL to limit access. Users should update to Apache Karaf 4.2.9 or newer.

Risk Information

Base Score

6.3

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS Score

Exploitation Probability

0.514

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-11980 are fixed in Apache-org.apache.karaf.management.server 4.2.9	Windows
Vulnerabilities CVE-2020-11980 are fixed in Apache-org.apache.karaf.management.server for Linux 4.2.9	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234