[OFBIZ-12080] Secure the uploads

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Trunk
• Fix Version/s: 17.12.07, 18.12.01
• Component/s: ALL APPLICATIONS, ALL PLUGINS
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 30/Nov/20 17:32
• Updated: 11/Jun/22 12:48
• Resolved: 16/Apr/21 07:26

Description

2020/08/10 the OFBiz security team received a security report by Harshit Shukla <[e-mail]>, roughly it was (quoting part of it to simplify):

I have identified a Remote Code Execution (RCE) Vulnerability. The reason behind this RCE is lack of file extension check at catalog/control/UploadCategoryImage?productCategoryId=CATALOG1_BEST_SELL&pload_file_type=category

Using this post-auth RCE in OFBiz demos, Harshit was able to get some AWS credentials by uploading a webshell (based on [0]). By security, it was then decided by the Infra and OFBiz security teams to shut down the demos.

After I decided we needed to secure all our uploads and not only checking extensions, I began to work on the vulnerablity. During this work I discovered, according to [1] and [2], that these AWS credentials are so far considered harmless.

This post-auth RCE relies on the demo data. In our documentation[3], we warn our users to not use the demo data. Notably because they allow to sign in as an admin!

After discussing these elements with Mark J Cox (VP of ASF security team[4]) we in common decided that no CVE was necessary.

[0] https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/jsp/cmd.jsp
[1] https://ibreak.software/2020/04/what-are-these-reserved-set-of-security-credentials-in-aws/
[2] https://twitter.com/SpenGietz/status/1104198404471631872
[3] https://cwiki.apache.org/confluence/display/OFBIZ/How+to+secure+your+deployment
[4] https://awe.com/mark/history/index.html

Issue Links

• breaks: OFBIZ-12297 Wrong uploaded file checked in Image Management [CVE-2021-37608]
• is duplicated by: OFBIZ-11948 Remote Code Execution (File Upload) Vulnerability
• is duplicated by: OFBIZ-11949 Local File Inclusion vulnerability
• is duplicated by: OFBIZ-12052 Improves uploads
• mentioned in: Page Loading...