Apache Karaf’s shell\/SSH command security is enforced by per-scope ACL configuration files (etc\/org.apache.karaf.command.acl..cfg).\u00a0SecuredSessionFactoryImpl.checkSecurity()\u00a0resolves the roles required for an invocation and, when no ACL rule matches the command, fails open:\u00a0ACLConfigurationParser.Specificity.NO_MATCH\u00a0sets\u00a0passCheck = true. The safety valve for this,\u00a0karaf.secured.command.compulsory.roles, ships commented out in\u00a0etc\/system.properties, so an unmatched command is allowed for any authenticated user.<\/p>\n
The shipped\u00a0org.apache.karaf.command.acl.config\u00a0ACL (assemblies\/features\/standard\/src\/main\/feature\/feature.xml, mirrored into\u00a0instance\/…\/etc\/org.apache.karaf.command.acl.config.cfg) has no\u00a0install\u00a0entry. It restricts\u00a0delete\u00a0to\u00a0admin, restricts\u00a0edit\/property-*\/update\u00a0on the\u00a0jmx.acl.*,\u00a0org.apache.karaf.command.acl.*\u00a0and\u00a0org.apache.karaf.service.acl.*\u00a0PIDs to\u00a0admin, and allows\u00a0manager\u00a0for everything else, but\u00a0config:install\u00a0was simply unmatched, and therefore allowed for any authenticated user, including one holding only the\u00a0viewer\u00a0role.<\/p>\n
config:install \u00a0fetches\u00a0url\u00a0and writes it into\u00a0${karaf.etc}\u00a0as\u00a0finalname. It calls\u00a0PathUtils.checkWithin()\u00a0to block\u00a0..\u00a0traversal outside\u00a0karaf.etc, but that folder holds every security-relevant file Karaf ships:\u00a0users.properties,\u00a0keys.properties,\u00a0host.key, and all\u00a0org.apache.karaf.*.acl.*\u00a0files, including the very ACL file that (mis)governs this command. With\u00a0-o\/–override, an existing file is overwritten with attacker-controlled bytes fetched from an arbitrary URL.<\/p>\n
Because\u00a0felix.fileinstall.dir = ${karaf.etc}\u00a0(etc\/config.properties), Felix FileInstall also watches and reloads any\u00a0.cfg\u00a0file dropped there, closing the loop without requiring a restart.<\/p>\n
By contrast,\u00a0bundle:install,\u00a0feature:install\u00a0and\u00a0kar:install\u00a0are all\u00a0admin-only in their own ACLs, and\u00a0config:delete\u00a0is\u00a0admin\u00a0in this same ACL,\u00a0config:install\u00a0was the outlier.<\/p>\n
MitigationAdd\u00a0install = admin\u00a0in\u00a0etc\/org.apache.karaf.command.acl.config.cfg\u00a0(create the file is absent), and\/or set\u00a0karaf.secured.command.compulsory.roles=admin\u00a0in\u00a0etc\/system.properties\u00a0(and restart) to make unmatched commands fail closed by default.<\/p>\n","protected":false},"excerpt":{"rendered":"
Apache Karaf’s shell\/SSH command security is enforced by per-scope ACL configuration files (etc\/org.apache.karaf.command.acl..cfg).\u00a0SecuredSessionFactoryImpl.checkSecurity()\u00a0resolves the roles require<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-30429","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/30429","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30429"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30429"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30429"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}