[KARAF-4993] Unsecured access to gogo console over web

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 4.1.0, 3.0.8, 4.0.8
• Fix Version/s: 3.0.9, 4.0.9, 4.1.1
• Component/s: karaf
• Assignee: Christian Schneider
• Reporter: Christian Schneider
• Created: 24/Feb/17 08:01
• Updated: 16/Sep/18 04:43
• Resolved: 14/Mar/17 16:31

Description

Start plain karaf 4.1.0

feature:install webconsole http-whiteboard

Acess http://localhost:8181/gogo/
Unsecured access to the gogo console

If I use http://localhost:8181/gogo
NPE http://apaste.info/wQTBD

So it seems like the http whiteboard extender picks up the gogo webconsole plugin.
Thanks to Kevin Schmidt for finding this issue.

Issue Links

• is broken by: KARAF-2634 Specify the alias when registering servlets to eliminate warnings
• links to: CVE-2018-11787