CVE-2014-0120: CSRF
Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."
Other sources
hawtio-karaf-terminal is vulnerable to Cross-Site Request Forgery (CSRF) attacks. A remote attacker could provide a specially-crafted web page that, when visited by a user logged in to the hawt.io web console, could allow the attacker to run arbitrary commands on the underlying Karaf server.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0120?
CVE-2014-0120 has a high severity as it allows remote attackers to hijack user authentication and execute commands on the Karaf server.
How do I fix CVE-2014-0120?
To fix CVE-2014-0120, update to a version of Hawt.io that is greater than 1.2.2 or update Red Hat JBoss Fuse to a version later than 6.1.0-beta.
What types of systems are affected by CVE-2014-0120?
CVE-2014-0120 affects systems running vulnerable versions of Hawt.io and Red Hat JBoss Fuse.
What attack vector is used in CVE-2014-0120?
CVE-2014-0120 exploits cross-site request forgery (CSRF) to hijack authentication.
What potential impact does CVE-2014-0120 have on security?
CVE-2014-0120 can lead to unauthorized command execution on the Karaf server, compromising the security of the entire system.