A vulnerability, which was classified as critical, was found in Apache Karaf up to 4.2.2. Affected is an unknown part of the component kar Deployer. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on integrity, and availability. CVE summarizes:

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with ".." directory names and break out of the directories to write arbitrary content to the filesystem. This is the "Zip-slip" vulnerability - https://snyk.io/research/zip-slip-vulnerability. This vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf releases prior 4.2.3 is impacted.

The bug was discovered 03/07/2019. The weakness was presented 03/21/2019 (Website). The advisory is shared for download at securityfocus.com. This vulnerability is traded as CVE-2019-0191 since 11/14/2018. The exploitability is told to be easy. It is possible to launch the attack remotely. A authentication is necessary for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

The vulnerability was handled as a non-public zero-day exploit for at least 14 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 4.2.3 eliminates this vulnerability.

Further details are available at snyk.io. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Apache

Name

• Karaf

Version

• 4.2.0
• 4.2.1
• 4.2.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion