[QPID-8600] [Broker-J] File path validation in management-http plugin

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: qpid-java-broker-8.0.6
• Fix Version/s: qpid-java-broker-9.0.0
• Component/s: Broker-J
• Assignee: Unassigned
• Reporter: Daniil Kirilyuk
• Created: 09/Sep/22 07:31
• Updated: 11/Nov/22 12:25
• Resolved: 27/Oct/22 13:31

Description

HTTP management plugin initiates a network connection in classes FileServlet to a third-party system using user-controlled data for resource URI. This vulnerability may be leveraged to send a request on behalf of the web server since the request will originate from the web server's internal IP address.