CVE-2022-24721: Improper Authorization in org.cometd.oort
Summary
CVE-2022-24721: Improper Authorization in org.cometd.oort. Affects org.cometd.java:cometd-java-oort across 3 version ranges.
< 5.0.11
>= 6.0.0, < 6.0.6
>= 7.0.0, < 7.0.6
Fixed in 5.0.11, 6.0.6 or 7.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The org.cometd.java:cometd-java-oort package is a component of the CometD project, which is an open-source implementation of the Bayeux protocol. The package provides functionality for clustering CometD servers using the Oort and Seti channels. These channels allow communication between different instances of CometD servers in a cluster. However, prior to version 5.0.11, 6.0.6, and 7.0.6, the package had an improper authorization vulnerability that allowed remote users to subscribe and publish to the Oort and Seti channels without proper authentication. This vulnerability could lead to unauthorized access to sensitive data, modification of data, and manipulation of the cluster structure.
Vulnerability Detail
The vulnerability in org.cometd.oort allows remote users to subscribe and publish to the Oort and Seti channels without proper authorization. This means that any remote user can access and manipulate cluster-internal traffic, potentially exposing sensitive data. By subscribing to these channels, an attacker can monitor the communication between different instances of CometD servers in the cluster, gaining access to potentially sensitive information. Additionally, by publishing to these channels, an attacker can modify or delete data belonging to other users and manipulate the structure of the cluster. The vulnerability affects versions up to 5.0.10, 6.0.5, and 7.0.5 of the package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.0.115.0.11 -
>= 6.0.0, < 6.0.66.0.6 -
>= 7.0.0, < 7.0.67.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround can be implemented by installing a custom SecurityPolicy that forbids subscription and publishing to remote, non-Oort, sessions on the Oort and Seti channels. This workaround can be applied to any affected version of the package. The custom SecurityPolicy should be configured to only allow authorized users to subscribe and publish to the Oort and Seti channels, ensuring that only trusted entities can access and manipulate the cluster-internal traffic.
Conclusion
The org.cometd.java:cometd-java-oort package prior to version 5.0.11, 6.0.6, and 7.0.6 is vulnerable to improper authorization, allowing remote users to subscribe and publish to the Oort and Seti channels without proper authentication. This can result in unauthorized access to sensitive data, data modification, and manipulation of the cluster structure. It is recommended to update the package to the fixed versions or apply the provided workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.cometd.java:cometd-java-oort →
FAQ
The vulnerability allows remote users to subscribe and publish to the Oort and Seti channels without proper authorization. This can lead to unauthorized access to sensitive data, modification of data, and manipulation of the cluster structure.
Versions up to 5.0.10, 6.0.5, and 7.0.5 of the org.cometd.java:cometd-java-oort package are affected by this vulnerability.
To fix the vulnerability, update the package to version 5.0.11, 6.0.6, or 7.0.6, where the issue has been resolved.
Yes, a workaround is available by installing a custom SecurityPolicy that restricts subscription and publishing to authorized users on the Oort and Seti channels.
More information about this vulnerability can be found in the CometD project's GitHub repository: cometd/cometd#1146
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
