GHSA-xcxf-7q4p-cj26: CSRF
A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jolokia:jolokia-coreto a version that resolves this vulnerability.Fixed in 1.6.1 - Upgrade
Upgrade
Jolokiato a version that resolves this vulnerability.Fixed in 1.6.1
Event History
Frequently Asked Questions
Do strict Origin and Referer header checks protect against this issue?
No. The flaw affects properly configured instances even when strict checking of Origin and Referer headers is enabled.
What does an attacker need to exploit the vulnerability?
The listed attack vector is network-based, with no privileges or user interaction required. Successful exploitation could result in remote code execution.
How can I determine whether my deployment is affected?
Check the jolokia-core version in use. Versions from 1.2 up to, but not including, 1.6.1 are affected.