CVE-2024-3046: Eclipse Kura LogServlet Vulnerability
Summary
CVE-2024-3046: Eclipse Kura LogServlet vulnerability. Affects org.eclipse.kura:org.eclipse.kura.web2 versions >= 2.0.600, <= 2.4.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Kura is an open-source framework for building IoT gateways. It provides a platform for developing and managing IoT applications. The LogServlet component in Eclipse Kura versions 5.0.0 to 5.4.1 is vulnerable to an attack where an unauthenticated user can retrieve device logs. Additionally, an attacker can exploit downloaded logs to perform privilege escalation using the session ID of an authenticated user found in the logs.
Vulnerability Detail
The vulnerability in the Eclipse Kura LogServlet component allows unauthorized access to device logs and potential privilege escalation. By sending a specially crafted request to the servlet, an unauthenticated user can retrieve device logs. These logs may contain sensitive information, including session IDs of authenticated users. An attacker can then use this information to escalate their privileges within the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advised to restrict access to the LogServlet component or disable it if not required. This can be done by modifying the configuration of the Eclipse Kura gateway. Here is an example of how to disable the LogServlet in the Kura properties file:
org.eclipse.kura.web2.LogServlet.enabled=false
Please note that this workaround may limit the functionality of the gateway and should only be used until a proper fix can be applied.
Conclusion
The Eclipse Kura LogServlet vulnerability allows unauthorized access to device logs and potential privilege escalation. It is crucial to upgrade to a fixed version of Eclipse Kura to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.kura:org.eclipse.kura.web2 →
FAQ
Eclipse Kura is an open-source framework for building IoT gateways. It provides a platform for developing and managing IoT applications.
The vulnerability affects Eclipse Kura versions 5.0.0 to 5.4.1.
By sending a specially crafted request to the LogServlet component, an unauthenticated user can retrieve device logs. These logs may contain sensitive information, such as session IDs, which can be used for privilege escalation.
Yes, upgrading to a version of Eclipse Kura beyond 2.4.0 will include a fix for this vulnerability.
A temporary workaround is to restrict access to the LogServlet component or disable it if not required. However, this may limit the functionality of the gateway and should only be used until a proper fix can be applied.
