CVE-2014-0121: Critical severity red hat hawtio vulnerability
hawtio-karaf-terminal does not apply any authentication or authorization constraints by default. A remote attacker could use this flaw to run commands in the Karaf terminal, and therefore execute arbitrary code in the context of the Karaf server process.
Other sources
The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0121?
CVE-2014-0121 is considered a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2014-0121?
To fix CVE-2014-0121, configure authentication and authorization for the Hawt.io Karaf terminal.
What is the impact of CVE-2014-0121?
The impact of CVE-2014-0121 is that an unauthenticated attacker could execute arbitrary commands on the Karaf server.
Which versions are affected by CVE-2014-0121?
CVE-2014-0121 affects all versions of Hawtio up to 1.2.2 and Red Hat JBoss Fuse 6.1.0-beta.
Is CVE-2014-0121 exploitable remotely?
Yes, CVE-2014-0121 is exploitable remotely due to lack of authentication in the Hawt.io Karaf terminal.