Bug 1205140 (CVE-2015-0251)

Summary:
========

  Subversion's mod_dav_svn server allows setting arbitrary svn:author
  property values when committing new revisions.  This can be accomplished
  using a specially crafted sequence of requests.  An evil-doer can fake
  svn:author values on his commits.  However, as authorization rules are
  applied to the evil-doer's true username, forged svn:author values can
  only happen on commits that touch the paths the evil-doer has write
  access to.

  Doing so does not grant any additional access and does not circumvent the
  standard Apache authentication or authorization mechanisms.  Still, an
  ability to spoof svn:author property values can impact data integrity in
  environments that rely on these values.

  There are no known instances of the problem being exploited in the wild,
  but an exploit has been tested.

Details:
========

  The Subversion http://-based protocol used for communicating with
  a Subversion mod_dav_svn server has two versions, v1 and v2.  The v2
  protocol was added in Subversion 1.7.0, but the server allows using both
  protocol versions for compatibility reasons.  When a commit happens, the
  client sends a sequence of requests (POST, PUT, MERGE, etc.) that depend
  on the negotiated protocol version.

  Usually, a server uses the name of the authenticated user as the svn:author
  value for a new revision.  However, with a specially handcrafted v1 request
  sequence, a client can instruct the server to use the svn:author property
  that she/he provided.  In this case, the server will use an arbitrary value
  coming from the client instead of the svn:author value originating from
  the authentication mechanism.

Severity:
=========

  CVSSv2 Base Score: 3.5
  CVSSv2 Base Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N

  We consider this to be a medium risk vulnerability.

  An attacker needs to have commit access to the repository to exploit the
  vulnerability.  The ability to spoof svn:author property values can impact
  data integrity in environments that expect the values to denote the actual
  commit author.  The real ID of the author could still be determined using
  server access logs.  However, it is also possible that a spoofed change
  could go in unnoticed.

  Subversion's repository hooks might see the real ID of the author or the
  forged value, depending on the hook type and the hook contents:

  - A start-commit hook will see the real username in the USER argument
  - A start-commit hook will see the real username when performing
    'svnlook propget --revprop -t TXN_NAME'
  - A pre-commit hook will see the forged username when performing
    'svnlook propget --revprop -t TXN_NAME'
  - A post-commit hook will see the forged username when performing
    'svnlook propget --revprop -r REV'

  Unfortunately, no special configuration is required and all mod_dav_svn
  servers are vulnerable.

Recommendations:
================

  No workaround is available.

Acknowledgements:

Red Hat would like to thank the Apache Software Foundation for reporting this issue. Upstream acknowledges Evgeny Kotkov of VisualSVN as the original reporter.