CVE-2020-25711: Improper Access Control in infinispan-server-runtime
Summary
CVE-2020-25711: Improper Access Control in infinispan-server-runtime. Affects org.infinispan:infinispan-core versions < 11.0.6.Final. Fixed in 11.0.6.Final. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The infinispan-core package is a part of the Infinispan project, which is an open-source, distributed, in-memory key-value data store and cache. It provides a highly scalable and performant solution for storing and retrieving data. The infinispan-server-runtime component is responsible for managing the server operations, including the REST API. This vulnerability affects versions of the infinispan-core package up to and including 11.0.5.Final.
Vulnerability Detail
The vulnerability (CVE-2020-25711) arises from improper access control in the infinispan-server-runtime component. When the authorization (authz) feature is enabled, certain server management operations, such as shutting down the server, are not properly checked for the required ADMIN role. This means that any authenticated user can perform these operations without the necessary permissions. The impact of this vulnerability is that unauthorized users can shut down the server, potentially causing service disruption or unauthorized access to sensitive data.
How To Fix
Minimum fixed version
11.0.6.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can disable the authz feature if it is not required for their deployment. This can be done by modifying the configuration of the Infinispan server to remove the authorization configuration. However, this workaround should only be considered if the authz feature is not necessary for the specific deployment.
Conclusion
In summary, the infinispan-server-runtime component of the infinispan-core package is vulnerable to improper access control, allowing unauthorized users to perform server management operations without the necessary permissions. To mitigate this vulnerability, it is recommended to upgrade to version 11.0.6.Final or any subsequent version. Alternatively, the authz feature can be disabled if not required. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.infinispan:infinispan-core →
FAQ
The impact of this vulnerability is that unauthorized users can perform server management operations, such as shutting down the server, without the necessary permissions. This can lead to service disruption or unauthorized access to sensitive data.
Versions of the infinispan-core package up to and including 11.0.5.Final are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to version 11.0.6.Final or any subsequent version of the infinispan-core package.
Yes, as a workaround, you can disable the authz feature if it is not required for your deployment. However, this should only be considered if the authz feature is not necessary for your specific use case.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-8674-26jc-wh98/GHSA-8674-26jc-wh98.json
Related vulnerabilities
Recent vulnerabilities recorded for org.infinispan:infinispan-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
