Dublin Portal Platform Security/Vulnerability Report

All available versions of moment.js are vulnerable. Upgrade is not an option.

Analysis: Not vulnerable as all our date fields are reformatted and validated before being submitted. See below

CVE 185 information: The moment package is vulnerable to Regular Expression Denial of Service (ReDoS). The monthsShortRegex(),monthsRegex(),weekdaysRegex(),weekdaysShortRegex(), and weekdaysMinRegex() functions in the moment.js, moment-with-locales.js, and regex.js files use a vulnerable regular expression while parsing the date input. A remote attacker can exploit this vulnerability by crafting a date input containing a very long sequence of repetitive characters which, when parsed, consumes available CPU resources and results in Denial Of Service.   PORTAL-531 - Getting issue details... STATUS

elasticsearch is vulnerable to Information Disclosure. The renderResponse() method in the RestClusterGetSettingsAction class fails to filter certain settings from the ClusterGetSettingsResponse object, and consequently exposes potentially sensitive information via the /_cluster/settings API endpoint. A remote authenticated attacker can exploit this vulnerability by sending a request to the affected cluster endpoint. This will result in the exposure of any sensitive information contained therein. See Jira ticket: PORTAL-532  PORTAL-532 - Getting issue details... STATUS

AngularJS is vulnerable to Cross-Site Scripting (XSS). The $SanitizeProvider() function in the sanitize.js file doesn't account for user input within the xml:base attribute SVG anchors. A remote attacker can exploit this vulnerability by injecting malicious JavaScript into the xml:baseattribute, which results in script execution when rendered by the browser.

The application is vulnerable by using this component only when enableSvg is enabled, and when using Firefox. By default, the svgEnabled is set to false in 1.5+ versions.   PORTAL-533 - Getting issue details... STATUS

The AngularJS framework is vulnerable to Remote Code Execution (RCE) and Cross-Site Scripting (XSS). The ensureSafeAssignContext() function in parse.js processes malicious expressions that access the constructors. A remote attacker can exploit this vulnerability by crafting malicious expressions that, when processed, result in execution of arbitrary code.

Recommendation

Each version of Angular 1 up to, but not including 1.6, contained an expression sandbox, which reduced the surface area of the vulnerability but never removed it. In Angular 1.6 we removed this sandbox as developers kept relying upon it as a security feature even though it was always possible to access arbitrary JavaScript code if one could control the Angular templates or expressions of applications.

Control of the Angular templates makes applications vulnerable even if there was a completely secure sandbox:  PORTAL-533 - Getting issue details... STATUS

Analysis: Not vulnerable as we do not use POI to read documents. We use only to generate XLS from our own data.

CVE CWE:399:

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).

PORTAL-446 - Getting issue details... STATUS

The impact of the springframework library is all over the project. So have to be very careful in upgrading the versions.

At least trying to resolve the multiple version use in Dublin - PORTAL-423 - Getting issue details... STATUS

Not clear what is the issue based on the Nexus IQ report information.

  PORTAL-534 - Getting issue details... STATUS

If not false positive, can be handled with the new version upgrade which do not have vulnerability.

PORTAL-443 - Getting issue details... STATUS

Explanation

Apache Commons FileUpload contains a resource leak which may lead to a Denial of Service (DoS) attack.

There is no non vulnerable version of this package.

PORTAL-445 - Getting issue details... STATUS

Explanation

Apache Xerces2 is vulnerable to a Denial of Service (DoS) attack.

If not false positive, can be handled with the new version upgrade which do not have vulnerability.

PORTAL-444 - Getting issue details... STATUS

Explanation

Bouncy Castle is vulnerable to Remote Code Execution (RCE).

If not false positive, can be handled with the new version upgrade which do not have vulnerability.

PORTAL-447 - Getting issue details... STATUS

Explanation

Groovy is vulnerable to insecure deserialization leading to Remote Code Execution (RCE).

If not false positive, can be handled with the new version upgrade which do not have vulnerability.

PORTAL-448 - Getting issue details... STATUS

Explanation

Eclipse Jetty Server is vulnerable to HTTP request smuggling.

There is no non vulnerable version of this component/package.

PORTAL-449 - Getting issue details... STATUS

Explanation

Apache Tomcat is vulnerable to a Cross-Origin attack due to the insecure default configuration of the CORS filter.

False positive

We do not use the below code, which is vulnerable.

System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");

PORTAL-450 - Getting issue details... STATUS

If not false positive, can be handled with the new version upgrade which do not have vulnerability.

PORTAL-441 - Getting issue details... STATUS

Explanation

The Hibernate Validator (HV) package is vulnerable to a privilege escalation vulnerability.

c3p0-0.9.5.2.jar The c3p0 component is vulnerable to XML eXternal Entity (XXE) attacks. PORTAL-535 - Getting issue details... STATUS

The postgresql package is vulnerable to Man-in-the-Middle (MitM) attacks. When using a non-default SSL Factory, the postgresql jdbc doesn't validate the hostname of SSL certificates. An attacker can potentially exploit this behavior to perform a MitM attack.   PORTAL-536 - Getting issue details... STATUS

The dom4j package is vulnerable to XML Injection. The QName() function in the QName class file does not properly sanitize the QName input attribute value(s). A remote attacker can exploit this vulnerability by injecting an XML object that contains arbitrary code in the element and attribute names, hence leading to XML Injection. PORTAL-537 - Getting issue details... STATUS

Description from CVE
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.7 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.

  PORTAL-538 - Getting issue details... STATUS

The jQuery package is vulnerable to Cross-Site Scripting (XSS). The parseHTML() function in the parseHTML.js, jquery.js files allow JavaScript to be executed immediately when it's embedded within the event attributes. An attacker can exploit this vulnerability by injecting malicious JavaScript containing events handlers which, when rendered, results in the execution of arbitrary script.   PORTAL-539 - Getting issue details... STATUS

The jQuery package is vulnerable to Cross-Site Scripting (XSS). The parseHTML() function in the parseHTML.js, jquery.js files allow JavaScript to be executed immediately when it's embedded within the event attributes. An attacker can exploit this vulnerability by injecting malicious JavaScript containing events handlers which, when rendered, results in the execution of arbitrary script.   PORTAL-540 - Getting issue details... STATUS

The bootstrap package is vulnerable to Cross-Site Scripting (XSS). The show() function in the tooltip.js file allows HTML and scripts in the data-container tooltip attribute values in the DOM elements without proper sanitization. This can be misused to cause XSS.   PORTAL-541 - Getting issue details... STATUS

zookeeper is being used in MUSIC. MUSIC team will be removing this in the next version and Portal will upgrade when it is released. Code changes will be required to integrate with the latest version.  PORTAL-576 - Getting issue details... STATUS

AntiSamy is vulnerable to Cross-Site Scripting (XSS). The package uses an HTML serializer that doesn't take HTML5 entities into consideration, such as :, (, and ). An attacker can exploit this to inject JavaScript into the context of the page.   PORTAL-542 - Getting issue details... STATUS

<script>
  var value = "This is a value&#x22;+[SOME_INJECTED_CODE]+&#x22;";
</script>

The most adequate way to avoid this and make JSON, JavaScript and CSS literal escapes safe to be used both in HTML and XHTML scenarios is to always escape not only /, but also the &. So the result of the above would be something like:  PORTAL-577 - Getting issue details... STATUS

Derived queries using any of the predicates ?startingWith?, ?endingWith? or ?containing? could return more results than anticipated when a maliciously crafted query parameter value is supplied.

The getPredicates() method of the QueryByExamplePredicateBuilder class does not properly escape wildcards in fields when processing the predicate options STARTING, ENDING, and CONTAINING.  PORTAL-605 - Getting issue details... STATUS

Spring Data Commons is vulnerable to Remote Code Execution (RCE). The setPropertyValuefunction in the MapDataBinder class does not properly restrict SpEL expression evaluation.

By creating a nested path (i.e. foo.bar.foo.bar) using the PropertyPath constructor (which is invoked in other functions in the PropertyPath class) an attacker can cause the application to crash due to memory exhaustion.  PORTAL-606 - Getting issue details... STATUS

The Spring Framework is vulnerable to Denial of Service (DoS). The toResourceRegions() and parseRanges() methods in the HttpRange class process range requests with a large number of extensive ranges which can overlap causing additional resource consumption.

Spring Framework is vulnerable to Cross-Site Tracing (XST) attacks. The HiddenHttpMethodFilterclass lets an attacker change the HTTP request method to TRACE.

Allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers, and MappingJackson2JsonView for browser requests. We are not vulnerable to this attack because we do not use MappingJackson2JsonView.  PORTAL-607 - Getting issue details... STATUS

The getMethods() method in the ReflectiveMethodResolver class, the canWrite method in the ReflectivePropertyAccessor class, and the filterSubscriptions() method in the DefaultSubscriptionRegistry class do not properly restrict SpEL expression evaluation.

The getValueInternal() method in the OperatorMatches class lacks a threshold at which to limit regular expression evaluation.   PORTAL-608 - Getting issue details... STATUS

The connectToServerRecursive and createSSLEngine methods in WsWebSocketContainer.javathat are used by the WebSockets client do not validate the hostname of SSL certificates.  PORTAL-609 - Getting issue details... STATUS

Vulnerable to Regular Expression Denial of Service (ReDoS). The readLine()function in the AttachmentDeserializer class and get() function in the MessageContextImplclass do not limit the size of the attachment header and the ContentDisposition() function in the ContentDisposition class uses an improper regular expression to parse the content-disposition header.  PORTAL-610 - Getting issue details... STATUS

Vulnerable to Regular Expression Denial of Service (ReDoS). The readLine()function in the AttachmentDeserializer class and get() function in the MessageContextImplclass do not limit the size of the attachment header and the ContentDisposition() function in the ContentDisposition class uses an improper regular expression to parse the content-disposition header.

When the handleMessage()method in the StaxInInterceptor class receives a request with Content-Type: text/htmlheader to a SOAP endpoint, it will generate an error using data from that request.  PORTAL-611 - Getting issue details... STATUS

The Object-Graph Navigation Language (OGNL) is vulnerable to a Denial of Service (DoS) as it uses an improper implementation of the cache used to store method references. getGetMethod() and getSetMethod() in OgnlRuntime.java contain performance issues that may be leveraged to conduct DoS attacks.  PORTAL-612 - Getting issue details... STATUS

The Apache commons-codec package contains an Improper Input Validation vulnerability. The decode() method in the Base32, Base64, and BCodec classes fails to reject malformed Base32 and Base64 encoded strings and consequently decodes them into arbitrary values.   PORTAL-615 - Getting issue details... STATUS

CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. 

The getCandidate() method in the CacheStrategy$Factory class fails to accommodate for non-ASCII characters within the ETagheader.

We will not use consul in post dublin release.  PORTAL-613 - Getting issue details... STATUS

The fastjson package is vulnerable to Remote Code Execution. The package uses the default class loader for multiple classes, which does not check for the presence of malicious characters in the user input.

We will not use this post dublin release.  PORTAL-614 - Getting issue details... STATUS