Bug 1636014 (CVE-2018-10683)

Summary:	CVE-2018-10683 wildfly: Missing authentication in edfault installation without a security realm reference
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aschwart, asoldano, bbaranow, bkundal, bmaxwell, bmcclain, boliveir, brian.stansberry, cdewolf, chazlett, csutherl, darran.lofthouse, dblechte, dfediuck, dimitris, dingyichen, dkreling, dosoudil, drichtar, drieden, eedri, fjuma, istudens, ivassile, iweiss, java-maint, jawilson, jkoops, jshepherd, lef, lgao, mgoldboi, mgoldman, michal.skrivanek, mosmerov, mperina, mposolda, msochure, msvehla, myarboro, nwallace, pdrozd, peholase, pesilva, pgier, pjindal, pmackay, psakar, pskopek, pslavice, psotirop, puntogil, rmartinc, rnetuka, rowaters, rstancel, rsvoboda, sbonazzo, sherold, smaestri, ssilvert, sthorger, tom.jenkinson, twalsh, vmuzikar, vtunka, ylavi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-10-04 09:10:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1534478

Description Adam Mariš 2018-10-04 09:08:09 UTC

An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a security realm reference" implies "effectively unsecured." The vendor explicitly supports these unsecured configurations because they have valid use cases during development.

Comment 1 Adam Mariš 2018-10-04 09:08:39 UTC

Acknowledgments:

Name: Jean-marie Bourbon (Excellium-Services), Anthony Maia (Excellium-Services)

Comment 2 Adam Mariš 2018-10-04 09:08:57 UTC

Statement:

Red Hat Product Security does not consider this issue to be a vulnerability. The default installation are by default secured and set to have an authentication mechanism in place. It is possible to explicitly remove the realm from the configuration files when needed. For example, in case there's need to run in single user mode for development use, ability to switch off security is desirable so the admin console can be accessed without the need for user accounts. There is adequate mechanism in place to secure the WildFly environment.