Description
The shell:cat command has no access control list associated with it in the default configuration.
The same is true of the "shell:ls" command. There may be other shell: commands too that can provide filesystem access. I don't know whether cd, pwd for example should be secured. "tac" most certainly should.
This means that any user that can access the ssh console can navigate the filesystem, reading and writing files as they like.
For example, given the default configuration, if I have a "normal" user and can therefore access the console, I can use shell commands to find our or guess the location of the karaf install (shell:pwd will do that), then cat the contents of the etc/users.properties file and find out all users passwords (in the default configuration the passwords are in plain text). I can also cat the etc/host.key file which would seem undesirable.
tac clearly would be a very dangerous command to have access to. It seems likely that I could subvert many things by just writing directly to configuration files using tac. I could, for example, change, or at least invalidate the admin password by rewriting the users.properties file.
All in all this feels like a major issue.
Attachments
Issue Links
- is related to
-
KARAF-5427 Add RBAC support for reflection invocation and redirections in the console
-
- Resolved
-