bugtraq - [CVE-2013-1814] Apache Rave exposes User over API

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 12 Mar 2013 17:22:25 -0400
From: Matt Franklin <mfranklin@...che.org>
To: security@...che.org, dev@...e.apache.org, users@...e.apache.org,
  full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [CVE-2013-1814] Apache Rave exposes User over API

CVE-2013-1814: Apache Rave exposes User over API

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Rave 0.11 to 0.20

Description:
Rave returns the full user object, including the salted and hashed
password, via the User RPC API.  This endpoint is only available to
authenticated users, but will return all User objects in the database
given the correct query.

Mitigation:
All users who rely on Rave's user management capabilities should
upgrade to 0.20.1 or later.
If an upgrade is infeasible, restrict access to the /app/api/user URL
paths via Spring Security configuration or other means.

Example:
A request to:

/app/api/rpc/users/get?offset=3DOFFSET

will return the following:

{"error":false,"errorMessage":null,"errorCode":"NO_ERROR","result":{"result=
Set":[{"entityId":1,"username":"canonical","email":"canonical@...mple.com",=
"displayName":"Canonical
User","additionalName":"canonical","familyName":"User","givenName":"Canonic=
al","honorificPrefix":null,"honorificSuffix":null,"preferredName":null,"abo=
utMe":null,"status":"Single","addresses":[],"organizations":[],"properties"=
:[{"entityId":1,"type":"thumbnailUrl","value":"http://opensocial2.org:8080/=
collabapp/images/avatars/BillRanney.jpg","qualifier":null,"extendedValue":n=
ull,"primary":null,"id":"1"}],"password":"$2a$10$TkEgze5kLy9nRlfd8PT1zunh6P=
1ND8WPjLojFjAMNgZMu1D9D1n4.","expired":false,"locked":false,"enabled":true,=
"openId":null,"forgotPasswordHash":null,"forgotPasswordTime":null,"defaultP=
ageLayout":{"entityId":4,"code":"columns_3","numberOfRegions":3,"renderSequ=
ence":3,"userSelectable":true},"confirmPassword":null,"defaultPageLayoutCod=
e":null,"authorities":[{"entityId":2,"authority":"ROLE_ADMIN","users":[],"d=
efaultForNewUser":false}],"id":"1","accountNonLocked":true,"credentialsNonE=
xpired":true,"accountNonExpired":true},
........ ],"pageSize":10,"offset":0,"totalResults":14,"numberOfPages":2,"cu=
rrentPage":1}}

Credit:
This issue was discovered by Andreas Guth of RWTH Aachen University.

References:
http://tomcat.apache.org/security.html