Bug 1169544 (CVE-2014-8114)

Summary:	CVE-2014-8114 UberFire: Information disclosure and RCE via insecure file upload/download servlets
Product:	[Other] Security Response	Reporter:	Pavel Polischouk <pavelp>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	etirelli, kverlaen, mproctor, pavelp, porcelli, rrajasek, rzhang, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was discovered that the default implementation of FileUploadServlet and FileDownloadServlet provided by the UberFire Framework did not restrict the paths to which a file could be written or read from. In applications using this framework and exposing these servlets, a remote attacker could gain access to information stored in files accessible to the application container process, or execute arbitrary code by uploading malicious content.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-02-17 23:33:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1169556, 1169557, 1169558, 1169559, 1169560, 1169561
Bug Blocks:	1168481, 1181883

Description Pavel Polischouk 2014-12-02 00:59:46 UTC

It was discovered that the default implementation of FileUploadServlet and FileDownloadServlet provided by the UberFire Framework did not restrict the paths to which a file could be written or read from. In applications using this framework and exposing these servlets, a remote attacker could gain access to information stored in files accessible to the application container process, or execute arbitrary code by uploading malicious content.

Comment 1 Pavel Polischouk 2014-12-02 01:57:53 UTC

Acknowledgements:

Red Hat would like to thank David Jorm for reporting this issue.

Comment 4 Pavel Polischouk 2015-01-30 16:27:15 UTC

Fix pushed to the following *feature branches*

https://github.com/uberfire/uberfire/tree/0.3.x-BZ1169544
https://github.com/droolsjbpm/guvnor/tree/6.0.x-BZ1169544
https://github.com/droolsjbpm/kie-wb-distributions/tree/6.0.x-BZ1169544

Fix pushed to product branches 0.3.x/6.0.x:

https://github.com/uberfire/uberfire/commit/21ec50eb15
https://github.com/droolsjbpm/guvnor/commit/eeb6232ffa
https://github.com/droolsjbpm/kie-wb-distributions/commit/90eed433d3

Fix pushed:

(0.3.x) https://github.com/uberfire/uberfire/commit/a471b260a2
(6.0.x) http://github.com/droolsjbpm/guvnor/commit/2058f3687
(6.0.x) http://github.com/droolsjbpm/kie-wb-distributions/commit/6fbed2d56

Comment 5 errata-xmlrpc 2015-02-17 22:31:20 UTC

This issue has been addressed in the following products:

  Red Hat JBoss BRMS 6.0.3

Via RHSA-2015:0235 https://rhn.redhat.com/errata/RHSA-2015-0235.html

Comment 6 errata-xmlrpc 2015-02-17 22:36:19 UTC

This issue has been addressed in the following products:

  Red Hat JBoss BPM Suite 6.0.3

Via RHSA-2015:0234 https://rhn.redhat.com/errata/RHSA-2015-0234.html