REDHAT-BUG-2527902: Low severity Red Hat WildFly vulnerability
There is a flaw in WildFly that allowstake-snapshot to write a copy of the server configuration to a file the caller names. It takes two parameters that become part of that filename, comment and name, and it sanitizes only comment. A name of ../../../../welcome-content/x- therefore drops the configuration wherever the caller likes.
The operation is available to Monitor, the lowest standard RBAC role, and that is deliberate. What is not deliberate is that Monitor can now choose a destination it is able to read back. RBAC refuses that role the configuration as a document, and refuses it the credentials inside the configuration. A snapshot is both, byte for byte.
Affected Software
Event History
Frequently Asked Questions
Which users are realistically able to exploit this issue?
Any caller with the WildFly Monitor RBAC role can invoke take-snapshot. Monitor is the lowest standard RBAC role, so exposure includes accounts intentionally granted read-oriented monitoring access.
What does an attacker need to do to access protected configuration data?
The attacker needs permission to call take-snapshot and must supply a crafted name parameter containing path traversal, such as ../../../../welcome-content/x-. This can place the snapshot in a location the Monitor-role caller can read, bypassing RBAC restrictions on directly reading the configuration and its credentials.
Is this limited to non-default or specially enabled functionality?
No special feature enablement is described. The affected take-snapshot operation is deliberately available to the standard Monitor role; the flaw is that the name parameter is not sanitized.
How can administrators determine whether their environment may be exposed?
Review whether untrusted or lower-privileged users hold the Monitor role and can invoke take-snapshot. Also inspect for snapshots written to unexpected, caller-controlled paths, particularly paths outside the intended snapshot location.