org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),
\nwhich backs the “config” MBean and the config:* shell commands, derives the file
\nit writes a configuration to from caller-supplied input without checking that
\nthe result stays inside\u00a0${karaf.etc}:<\/p>\n
* if the submitted property map contains a\u00a0felix.fileinstall.filename\u00a0entry, that value is turned directly into a\u00a0File\u00a0(getCfgFileFromProperty), so it can point to any absolute path the Karaf process can write to;
\n * otherwise the configuration PID is concatenated verbatim into the target file name (generateConfigFilename(): new File(karaf.etc, pid + “.cfg”)), so a PID containing “..” segments resolves outside\u00a0${karaf.etc}.\u00a0createFactoryConfiguration()\u00a0has the same issue via the factory PID\/alias.<\/p>\n
Both code paths are reachable by any caller holding the “manager” role under Karaf’s shipped command\/JMX ACL (org.apache.karaf.command.acl.conf.cfg:\u00a0“update = manager”). Such a user can therefore write attacker-controlled content to any file the Karaf process can write, including files the same ACL otherwise reserves to “admin” (etc\/users.properties,\u00a0etc\/*.acl.*.cfg,\u00a0etc\/org.apache.karaf.management.cfg, and similar), allowing a manager-role user to grant themselves the admin role or otherwise take over the container.<\/p>\n
ConfigMBeanImpl.install()\u00a0and the\u00a0config:install\u00a0shell command already guarded the equivalent risk on their own code path with a\u00a0finalname.contains(“..”)\u00a0string check, but that check does not stop absolute paths or symlink-based escapes, and it was never applied to\u00a0ConfigRepositoryImpl.update()\u00a0\/\u00a0createFactoryConfiguration()\u00a0at all.<\/p>\n","protected":false},"excerpt":{"rendered":"
org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),
\nwhich backs the “config” MBean and the config:* shell commands, derives the file
\nit writes a configuration to from calle<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-30427","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/30427","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30427"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30427"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30427"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}