CVE-2011-1911 in JasperReports Server Community Project
Summary
by MITRE
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/23/2025
The vulnerability identified as CVE-2011-1911 affects JasperReports Server Community Project versions 3.7.0 and 3.7.1, specifically within the JasperServer component. This issue stems from the predictable nature of the _flowExecutionKey parameter used in the application's web interface. The _flowExecutionKey parameter serves as a session identifier within the Spring Web Flow framework that JasperReports Server employs for managing user interactions and maintaining application state. When this parameter becomes predictable, it creates a significant security weakness that can be exploited by malicious actors.
The technical flaw lies in the implementation of the flow execution key generation mechanism which does not utilize sufficient entropy or randomization to ensure uniqueness and unpredictability. This predictability allows remote attackers to craft malicious requests that can manipulate the application's flow execution state. The vulnerability specifically enables cross-site request forgery attacks where attackers can forge requests that appear to originate from legitimate users, potentially leading to unauthorized actions within the JasperReports Server environment. The brute-force approach mentioned in the description indicates that attackers can systematically guess or enumerate valid flow execution keys to gain unauthorized access to the application's functionality.
The operational impact of this vulnerability is substantial as it allows attackers to perform CSRF attacks with relatively low effort. An attacker who can predict the _flowExecutionKey parameter can potentially execute unauthorized administrative actions, modify reports, access restricted resources, or manipulate user sessions. This vulnerability particularly affects the server-side functionality of JasperReports Server, which is commonly used for report generation, data visualization, and business intelligence tasks. The exposure of this vulnerability could lead to data breaches, unauthorized access to sensitive reports, and potential escalation to more severe security incidents within the organization's reporting infrastructure.
The vulnerability maps to CWE-352, which specifically addresses Cross-Site Request Forgery, and aligns with ATT&CK technique T1566.001 for Initial Access through spearphishing attachments. Organizations using affected versions of JasperReports Server should immediately implement mitigations including the upgrade to patched versions of the software, implementing proper anti-CSRF tokens with sufficient randomness, and deploying web application firewalls to detect and prevent exploitation attempts. Additionally, security controls should include monitoring for suspicious request patterns and ensuring that all user interactions with the application are properly authenticated and authorized through robust session management mechanisms. The predictable nature of the parameter indicates a fundamental flaw in the application's security architecture that requires immediate attention to prevent potential exploitation by threat actors.